{ "Event": { "published": true, "date": "2026-07-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-13", "timestamp": 1783987382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e52bcd03-4e62-46e7-a0d2-3a7c5d029a5b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd264cc-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783906311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906311, "uuid": "b575b73b-9d43-472e-ac20-f5504e9d7671", "comment": "Malware payload (Stealc)", "value": "80a7ec2630d7ff867cc05fa2b6c35158", "object_relation": "md5", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906311, "uuid": "745182aa-5b43-414b-b47b-17d7cf8d72ff", "comment": "Malware payload (Stealc)", "value": "0087b35d4460c970fb9890fcf6f64403a895ae9a0656af3d33bec8968634f6de", "object_relation": "sha256", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906311, "uuid": "cbc155a2-646f-4f25-aace-e7256863c32e", "comment": "Malware payload (Stealc)", "value": "2c9585c6a0a33d5bf167753d1f09fb056f02ab26", "object_relation": "sha1", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906311, "uuid": "123a45f9-a8f8-4999-99d3-336bb5cabf1c", "comment": "Malware payload (Stealc)", "value": "2ab00af5e098de856fb5c287c0ea71b23732ff2e014afc28a5acdabdd08ee0366c103bdb0a479ec60d1ea4617e2d09a3", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906311, "uuid": "c6a42397-5fa2-42d2-9f5e-6ef6a4cb510e", "value": "T1FDB5121177C8C036E6A9173388FAC2A62635BD71AB30D4CB73907EAD6D716D2A931317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906311, "uuid": "6ff00ce0-e519-4728-b9bb-1b7ac47fc5d9", "value": "49152:epMOLakgNv569D9SYC01yt88FaBMLRL11CCV50KnlRHlXzv:epRaTvAKYZ4RL11CCPLHxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906311, "uuid": "e799eaa5-4eb2-48f4-b39a-4d6b3affcb76", "value": 2351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906311, "uuid": "6f4d04db-361a-491a-ac8a-da9320857d46", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906311, "uuid": "1dc065f8-dc86-4cb4-b307-3d8d02e836ef", "value": "b5e9296e09961ff2_UndIcopslete2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f9c7e3-7ebb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783948040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948040, "uuid": "bd855f9c-ffd0-46c2-8ef2-34cc7bf652c9", "comment": "Malware payload", "value": "44baa5989d13f79b0be59f17e8db2087", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948040, "uuid": "ec6ef878-0134-469f-a5bd-c4e307c0645a", "comment": "Malware payload", "value": "01618f7dfafa7ede2c8d500f9994d2dbee387e5b834d834db5540534cac5f5c4", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948040, "uuid": "9a7901b4-045f-477f-9c76-aaa1825cff58", "comment": "Malware payload", "value": "97093aa4d8767685430b9d4bed682b9070f68ac0", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948040, "uuid": "36674b6c-16cd-4495-b6b8-e55bc97187ad", "comment": "Malware payload", "value": "6d88a7e8ce70d995232680940c17bcee25d193af0d0d705219f95ad84a3558b9ea23026528105c4e53f6cb09bc6b5883", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948040, "uuid": "c1ed5270-e629-4254-87fe-1c4223f5b073", "value": "T118B5371E80589338F3A9C8EC855E6E9170F937BC8CF291A8111B4AB057667E19FD3B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948040, "uuid": "411ce057-250d-45e8-8193-2c18721dcd97", "value": "6de9e7c03228f02b105fae288e336f0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948040, "uuid": "fc07fba3-8c1d-40e8-9383-e6b01dac4d9a", "value": "49152:x2obnRc0XRJHoDt5UunnsBMA8cHVEHP2xyNfI3cTpId/Q/lQTZLlmM:tRJ1JRs9q0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783948040, "uuid": "f01d9c3e-4cb5-4a47-bd47-8f2e53225320", "value": 2284032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783948040, "uuid": "7367b113-2693-4df7-b4ae-321f5c97245c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948040, "uuid": "310ccad6-979c-4c4c-999d-1935cc8dff4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3324534f-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783963252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963252, "uuid": "0949d26d-af9d-4d37-a9f6-90ceffb27e6b", "comment": "Malware payload (PureLogsStealer)", "value": "eb7e4287cd79a72aec49339df00ebcd6", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963252, "uuid": "27b7d071-c1cd-4af2-8435-64569fde049c", "comment": "Malware payload (PureLogsStealer)", "value": "01f82df6d640458c9852fcceff2893b668c150dc6e7ae83298533c5c1b5815d2", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963252, "uuid": "85046316-2605-45b5-9349-6117ef510e67", "comment": "Malware payload (PureLogsStealer)", "value": "fb4d76419ee50eaf7a8baff089a9d116cb84743a", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963252, "uuid": "b0926a60-2b91-4db0-8808-615c66a448aa", "comment": "Malware payload (PureLogsStealer)", "value": "1bbee37896584ce9c3f8bd6fbb242552e5e8e1cb53460c76c891047c1fe6362a4d0e9f5a11bd5577e058b08d2565ab5c", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963252, "uuid": "d2d954be-31a9-42de-8d7b-d8931389c978", "value": "T1EC252325BAD5E363D317A93C88E4C17D003DAD617E12901F32A8774CF9346B589BB239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963252, "uuid": "13dad482-d696-4ef7-8cdd-6480beb228e5", "value": "24576:7fwI/uHLINPWFQ5OmOsEsFusPTCiKJKb:7fwILEsOcEsFD+iKJKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963252, "uuid": "ccdb4e04-a110-4012-af4f-fee301dcd811", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963252, "uuid": "a4e91238-a02c-42a5-b241-e41f1ceefdf9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963252, "uuid": "1639dfb5-1065-4791-b87b-0a0c53df288e", "value": "Cerere pentru list\u0103 de pre\u021buri - Gi Group#01902.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b809e585-7e57-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783905064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905064, "uuid": "f281add6-6564-427b-bde8-40d67dc297fe", "comment": "Malware payload (RemusStealer)", "value": "7d266cb59d9721a5af42c7783d6af1b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905064, "uuid": "338e6afd-574e-4cda-bccb-94b2325a36b1", "comment": "Malware payload (RemusStealer)", "value": "027004739726842d8e416672cb7da85c43a75357984f818e27db5eb0dee0b600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905064, "uuid": "8acd5784-df43-4e5a-afa0-c473d3d9988a", "comment": "Malware payload (RemusStealer)", "value": "ca89687cc7cc4bf379c4dcf5fa8d396d9a763d48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905064, "uuid": "37f76f95-8886-4df2-b320-5c0512ea0d12", "comment": "Malware payload (RemusStealer)", "value": "6c69ff20a8b0ebdaad44182ee32b9b775c63777649fee6c634e4d998686987db8b6dcb69e6c6111ca4fd835707ec0cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905064, "uuid": "eb8626f8-c37f-4eb8-a26c-8bd002b2627f", "value": "T16C241967C25371FCD642C07863667232AB33BA3947349EF707A2C7359E22AC05E79925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905064, "uuid": "b5c2e1c0-80bb-4632-a355-21960290ba9e", "value": "20f35ed688f00eacb2c7ea603d9f248e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905064, "uuid": "cfcf7a12-f4b8-40aa-a151-a7cef0fc3192", "value": "3072:fp4sTRjivIaGBjkdWRBHgT6vrbq3l6gVu1nZw5lmiRyFZgzx55eZ:C+HHvz8l6gVu1nZwyicZgzx55eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783905064, "uuid": "da1b7738-38d3-4b17-afa4-182fae0e2c25", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783905064, "uuid": "0b2e62d1-3846-42fb-afe9-4eb1ebcca64a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905064, "uuid": "2ec035e5-6b27-4c30-9a3a-963211c686b0", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52276e8-7e4d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783900844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783900844, "uuid": "c7391cf2-31fa-4ea7-b06e-a2c940a1fde9", "comment": "Malware payload", "value": "f18174b0501012dda634c047d164f508", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783900844, "uuid": "a2ae73c3-cd66-401e-aa5e-e6eb74401f4b", "comment": "Malware payload", "value": "0383c4aaa366711c094df576babc604b41f133006c6f6d53ec5feab2d1cc56fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783900844, "uuid": "4e84f8c0-7005-4666-a1d2-66c8a0193032", "comment": "Malware payload", "value": "acc30497fa14baa750045ea5f44cd6788fc00798", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783900844, "uuid": "efdce6b7-8114-4e4e-ac9b-2805209e6ec1", "comment": "Malware payload", "value": "74fe4b32e85423fe51075e2774f34221826214f77d335267b74fde8a2194070c20a43fb1216420532db01d324c378b7d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783900844, "uuid": "7e558579-077c-4178-a4e3-c5eee700ca9a", "value": "T157C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783900844, "uuid": "66e2ede1-db8c-4809-a87a-88780f9776a3", "value": "768:08vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:08l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783900844, "uuid": "c26322fe-ab2e-48c6-a609-7b6780e6d9ce", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783900844, "uuid": "a960887c-037d-41c1-8f03-11baf3b4cd49", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783900844, "uuid": "18894845-93e1-43b4-ad0b-0593b824f602", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ada7e53-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963399, "uuid": "aee176a0-c0ce-40f0-a86b-82a4ae80c860", "comment": "Malware payload", "value": "1b75879982a719a41f912cbb208da95c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963399, "uuid": "851a2fa6-f781-4c22-9ecc-17be43cfd602", "comment": "Malware payload", "value": "03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963399, "uuid": "b96b432b-f87c-4415-af63-6bda2856e40b", "comment": "Malware payload", "value": "833a4f4511df76fe92a7ad80961b346e9e2273bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963399, "uuid": "827af4a8-a5d8-4b6a-b0b6-1c86ab6ef28c", "comment": "Malware payload", "value": "7d66dc87e9e8302cdade889b2814ab5f330c562db100a1425387747135c1fe03451c5b2c890fbae71bf3f9c385c028eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963399, "uuid": "659fc8d5-10bb-45cc-bcba-dfb567b270e9", "value": "T12466D019D29350FCC67FC6718A1BB233FA60B42D5630A92E5B44DF786E15EA01E1DF28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963399, "uuid": "0be227d6-f305-4ac5-aedc-cac3c62d5f29", "value": "e1746c6965a6d5005de53ba4f2a07758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963399, "uuid": "ec9e4b46-a073-4bd9-a8b9-ccb75c0da5e8", "value": "196608:plvt5OsD1GNuAQ9Nc3wt9Gx7CmC8scTBmYyeDZ4QieF4rwu1qm:pb5V1drc372ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963399, "uuid": "0047f1e7-f7c7-46aa-944e-72b1fb5b5c71", "value": 6590464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963399, "uuid": "92e2fe96-5e2c-486f-92aa-f80554897f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963399, "uuid": "af9e0045-d1a6-43e6-b444-2aa1120b84c0", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcc2c00-7e73-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783917210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783917210, "uuid": "a70c2eb4-1d82-4119-8ca6-a95e0ce7291c", "comment": "Malware payload (RemcosRAT)", "value": "4ff0905a5b5b67115a2be909208875e8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783917210, "uuid": "f6ff4155-7ce0-4777-9f46-c08891d496b2", "comment": "Malware payload (RemcosRAT)", "value": "04052c109be755361fd73902875a6552446525cc09d68a9b81eed56b9386d2e1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783917210, "uuid": "11b52375-8879-409a-a4da-d9500e084452", "comment": "Malware payload (RemcosRAT)", "value": "85d769a8bec6474f3049bf2dc65aeecc49bcdb11", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783917210, "uuid": "6fc35b83-5fec-440f-916b-9c06ce3523fc", "comment": "Malware payload (RemcosRAT)", "value": "bcb80d1cdcacbba30d7b819cd26dc0f0835be689d5b4766781328c4f902476e0a2be5023ed25fd6f30f9ae48fc04d774", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783917210, "uuid": "02fd3dca-63d5-47a5-8d00-6a42c9b9f1f4", "value": "T10D7349B1DE5506554E0B27AEFC812A61C4BC8216463740E1FFEC274D500EAACF7BEA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783917210, "uuid": "5331985e-3dee-4ef8-89ea-3db05ea8aab2", "value": "1536:1zdove1m/gyuxpbU1Mxod48UZNKrIGY7KU7K:10tiwDdVU/IIGaK8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783917210, "uuid": "1005bd20-dd56-4c7e-b7dc-43cfbbb019e8", "value": 75551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783917210, "uuid": "9622011f-b4c9-422f-b005-269870889b8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783917210, "uuid": "ffe3ef3c-b5db-48a6-b22e-b1fa08db88e9", "value": "Reese.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10097674-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783963193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963193, "uuid": "c6dc695a-6fe5-41c8-845d-911f88a07633", "comment": "Malware payload (PureLogsStealer)", "value": "3fb1c212e0e1f2b02a6c5fb82c43bfea", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963193, "uuid": "98e74682-ccff-4790-9d31-1bdf4bc7aca6", "comment": "Malware payload (PureLogsStealer)", "value": "05fd60735b593c0e809807b14f7d0d1d717aba1fdd62171fbf15ae771846bb3e", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963193, "uuid": "4b430cd1-e240-4715-bcdd-74f0f356f934", "comment": "Malware payload (PureLogsStealer)", "value": "8307b8b713b7f4107b6ecc678971a9c1b5a01c5d", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963193, "uuid": "fe6b44ba-6b70-4f01-869f-2a6cf7083c2b", "comment": "Malware payload (PureLogsStealer)", "value": "592bb47256896c9f2e0b028702a0d141a9705c44c0361e45f1b181a656756dfd10174a5a1403db4dfb670d472b30448c", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963193, "uuid": "eddf79fd-bc54-4264-b1d3-c101e5727c75", "value": "T1D4252349FB9FCB67C09369399496C49E015EFD81FE0AD20B33613B1E6131627E6CB624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963193, "uuid": "4b8266e9-0b85-4683-beba-c95f84559250", "value": "24576:ifwI/uycZyYKbcp0NjdGAjPTExjhsE+K6G:ifwIJYKbcKNAALT6SJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963193, "uuid": "c4a98f6f-2b4b-4e3f-b470-55f520979528", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963193, "uuid": "3476c81c-9eaf-4284-9e7e-bd1a1394ade8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963193, "uuid": "acab1bc2-e234-4e86-b20b-d1fa5f4792ef", "value": "Comanda HABAU 4500006893.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a527bf-7ee7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783966692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966692, "uuid": "9b59aba0-33fa-4bde-b438-5c347f67bb00", "comment": "Malware payload (Vidar)", "value": "cc0c93a66edc35a092d48a503b6e4901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966692, "uuid": "3b379f9d-4976-4285-8a69-edf475294212", "comment": "Malware payload (Vidar)", "value": "07c295310759ecd7a42fbf3cb96ca1c5b7f45c7e59ac9704b78431000fae5a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966692, "uuid": "e273de2f-4cd7-4477-a961-b8d035efd470", "comment": "Malware payload (Vidar)", "value": "e40c17a79d7afb53b610f7db1650c4bcbc87e0a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966692, "uuid": "5e5ee566-ed6d-461a-b7b4-19cb5881040b", "comment": "Malware payload (Vidar)", "value": "f6a26531b1a7ac773d19cfddab7c1298fea13d939db82bc2f833e1bb7cb1d604720c56b7ea5e7aa56ea0e0fdd65b47ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966692, "uuid": "1cf5de3f-6ead-4fac-b77d-958bf392cb1b", "value": "T15FF7339043858759D1CBAFF8617F1EE3EE2B1EE0B219A09F46A28431F5D9467C68C14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966692, "uuid": "d1d141b6-94d0-46c8-9d01-35391fa24d0a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966692, "uuid": "00df2775-c582-4731-ba10-97923870aeda", "value": "1572864:2LdkWMp0R6FIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7w7:22HI6aABZVPArg/bXeB7w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783966692, "uuid": "00edae4f-1a6d-4dff-9583-7ff4ba90ab1b", "value": 70694976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783966692, "uuid": "e861c1ea-8051-4b05-8b6a-2375e5307fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966692, "uuid": "987ee168-8cd5-4e9d-b545-4900afec7d1a", "value": "Extreme Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9055aa35-7ee8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783967274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967274, "uuid": "85f033d2-75ed-4184-b5cf-6465625a6e0e", "comment": "Malware payload", "value": "3b02cf0e2480ee061c12b94893ea0e92", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967274, "uuid": "d905d6f2-f9f8-4413-b302-3ed844ca3fc5", "comment": "Malware payload", "value": "07d05727718563e2e21b06cc7b92c3c67efaf3b5b978e6f98823ba9e6608d2dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967274, "uuid": "1cafe7d4-bbcd-456d-a014-e959e1a815eb", "comment": "Malware payload", "value": "b7783cc01366627fe798f2b9aca6c8079053fe30", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967274, "uuid": "4b27382f-8d9f-4789-acba-4af80fc6a618", "comment": "Malware payload", "value": "20cc18e86b006717d6f6aa9192ec00e3947cee67a581b9d7b8b2b5c056a780c56305527f2b9868600791d16db2544bf7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967274, "uuid": "a5fd4af3-82e6-482d-9430-a63dcf569d8d", "value": "T160C27D956A867C44BEC98B3E4CBD2B0D6DF5C3D1224942AC3D8A3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967274, "uuid": "20d9a34e-c62d-468b-a25a-1666b6e8e89c", "value": "768:ab8vCB+25j6es8RwD9FYpMSUpi+20qUpi+20YQX:W8l25JCd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783967274, "uuid": "5cf4d76c-5f61-4416-bcd8-5055242f87fd", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783967274, "uuid": "84769e4b-01b8-4d16-a28d-af90747fd552", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967274, "uuid": "5901b0a4-a430-420c-a797-9808adaf2b61", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87df5b23-7ec0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783950080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950080, "uuid": "96ebbe9c-11c7-4aee-8d0e-99f6154f7379", "comment": "Malware payload (Formbook)", "value": "42d60e249dab73703bcd2935334f5cf3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950080, "uuid": "1c3e231c-1dc5-4d67-abdb-bb52244ebd9b", "comment": "Malware payload (Formbook)", "value": "09a78d4ca618d275809fa2af5f6f1b9b40d5ed2e552ba6ff1ef66b59ccaa1531", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950080, "uuid": "8893af49-5efe-4cef-a644-7f343c7b0ae0", "comment": "Malware payload (Formbook)", "value": "7f8f8efb940ccc5f70887a1d36598366a5d127ad", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950080, "uuid": "a0b000b3-2ee5-44ec-92e0-d8fb78a815c0", "comment": "Malware payload (Formbook)", "value": "163942cb3b81d50bc7b812b736d98b48dd14bfff30b3c649a9201c2296e89e90919c39f36a622a9bb50c2bc20be30adc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950080, "uuid": "9231293c-ef63-4be0-8a59-5f0a7ccd8c61", "value": "T1F04523A08D999CFB85ECA22DB84F8D1E8FF40635C047D0F762C0AC9E5AAAF5145474B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950080, "uuid": "bcab6c2b-d8b8-47be-89d2-2fa8b845818f", "value": "24576:uARMo7aPyp5pBZWMbOMtsk1VdmvHS1c/7eq2CdUAS520vEtGzKwwkHLAZgmIjdJU:ywFEMiJ5fPppgHLAZII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783950080, "uuid": "9ef6abae-fbe9-47c2-8823-53541334f5e6", "value": 1266395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783950080, "uuid": "08513496-c6fe-4915-b968-dd8682b9888b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950080, "uuid": "ca3c0b65-6a24-41a5-a593-eb946df137d9", "value": "PO NO. 2500510 COLORSTAR CHEMICAL INDUSTRIAL CORPORATION.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c4e90e-7eca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783954344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954344, "uuid": "c397d4a7-79a5-4561-bab5-4238079c94d2", "comment": "Malware payload (Stealc)", "value": "dc97d08061dcc998c1033ef07b5199a6", "object_relation": "md5", "Tag": [ { "name": "160-20-109-75", "colour": "#95D252", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954344, "uuid": "211ee220-450f-4d3f-9f79-8a2a10aaf1e4", "comment": "Malware payload (Stealc)", "value": "09abf355cbd02decf15685d6dfc47e032edd30546da64425e56721490695ffbb", "object_relation": "sha256", "Tag": [ { "name": "160-20-109-75", "colour": "#95D252", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954344, "uuid": "60316ac2-c290-4edd-9950-9cdd37a06f74", "comment": "Malware payload (Stealc)", "value": "361bdcf246f96e3260b22e925dbea57532e7d385", "object_relation": "sha1", "Tag": [ { "name": "160-20-109-75", "colour": "#95D252", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954344, "uuid": "bbc597ac-79fa-4b15-973c-2a600f295eb1", "comment": "Malware payload (Stealc)", "value": "671b3428a6d730eaa46c04846550a7cd5a6d71e2c20682ce82b99997c25341af74283792b4b80d73668b75770c56be4c", "object_relation": "sha3-384", "Tag": [ { "name": "160-20-109-75", "colour": "#95D252", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954344, "uuid": "913a4bce-7d5c-4132-88a9-5e9a6528ee87", "value": "T1BDB68C076CD009F9D4AA673189F361967B35BC194B3623D32E90B6783F72AE18D36790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954344, "uuid": "b6d09c9c-8ccf-4fee-a0d4-747c0ed8dd37", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954344, "uuid": "fd538af4-d051-42ec-9a85-6d54d7e6db77", "value": "49152:7mNgaswRukyUSOqICt/gMWNJDrABPuB/gw:7mZVy9gVJmPuB/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783954344, "uuid": "70d57d28-4770-4c0e-af39-7ffb1a5a6273", "value": 11100008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783954344, "uuid": "3873bfdb-7851-44c0-b044-cc134c893ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954344, "uuid": "3fd4de46-50d5-41e3-93f0-13df35e3d1fb", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d05e3e-7e6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783913571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783913571, "uuid": "39fa1d6e-af0e-4164-8435-e19f4a7fcba8", "comment": "Malware payload (RemcosRAT)", "value": "4e7829f84d108462bf354ad2f0286471", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783913571, "uuid": "6986ab61-4e0a-4f21-858a-d53e2b8dca24", "comment": "Malware payload (RemcosRAT)", "value": "09cc1c77657400e803310dd7ba58a91854fb275e5b29adf53a6ee2827f848366", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783913571, "uuid": "d0aa1045-c80a-41f4-a47e-e75ca02c648e", "comment": "Malware payload (RemcosRAT)", "value": "213d3978a71fc890b8ed0fcf07187efb2a3215d6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783913571, "uuid": "17ba03d1-258f-4613-86af-641581809f0e", "comment": "Malware payload (RemcosRAT)", "value": "141ba153ed7adde7c81b7a9fe7d465e20b445f8dc566d2efd27071dcdef2e7e83a1795ddc7a3b717177518c1e6219a40", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783913571, "uuid": "fab77af4-8071-4f24-81b6-5764a5e4adb1", "value": "T16EC21CB2BB55028309DB31E7C97C0F278964C6A041317C64AFBA771E8847EDC67EE619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783913571, "uuid": "2b89523c-4286-4fd3-907b-75345fc14e4a", "value": "768:Atlxt/oChkD/pDIHL/H6DHyn0d+u0eF0QXTKhMtkbVA8NuS+Nq:qNNo/ro0d+u0edXTKh8kbO8Nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783913571, "uuid": "8545ca90-0900-4de4-b478-c486aa74e578", "value": 26215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783913571, "uuid": "e6b23a92-e779-433d-a64a-4147c32286b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783913571, "uuid": "1135584f-9a4a-41ac-8734-97d238135454", "value": "PDA-MV OCEAN WY-268546-1-PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4e13f2-7ee2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783964875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964875, "uuid": "b904183c-f52e-4874-9ae2-46eae367665a", "comment": "Malware payload (Mirai)", "value": "a5cd5a4c0c32f522bbb866a1264bd9b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964875, "uuid": "5480ebc4-ed8b-43ec-b743-bdc8ef385009", "comment": "Malware payload (Mirai)", "value": "09e16e8c91a64af5fc48711eb65e89ef3f7480a4fb540270b3a6c9328360735d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964875, "uuid": "a8be85b2-65b3-42a8-9052-e7519a25fc76", "comment": "Malware payload (Mirai)", "value": "7c5460ca9f9eb2c634c9fc2a37ab2feda1356198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964875, "uuid": "d866d516-85f4-43f9-8419-e3524729bf42", "comment": "Malware payload (Mirai)", "value": "f2fdd3e55e3a185400271506f37a2b8bf544aa349ea5fad937b1724e268641435e17aa1fa477aae81a625ea368a43d35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964875, "uuid": "a0d10bbf-dedb-4ed9-a569-0bb7716c8cf3", "value": "T12A647EE3FC01E9BEFC6ED732CC174A04B135E31158521A3A32A37779A92B0595973E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964875, "uuid": "eb5c1795-a369-446c-9aed-f102ace3960c", "value": "6144:mKv0rfkQbS6AhhvBoCzihiFs7uYdyn8zjE8Lh9uqLmU2p1:vZnvBoCzihiFs7ZLKZp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783964875, "uuid": "f2670ada-190e-4292-b79c-65ff452c445d", "value": 326060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783964875, "uuid": "51dc01a3-41eb-40b6-ae67-5ec94537767e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964875, "uuid": "6c70aa2d-abde-430b-8141-416b1134b0ed", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ff2261-7eb7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783946310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946310, "uuid": "ea6cd0c9-853b-433a-bd07-c8bffa4bea63", "comment": "Malware payload", "value": "ac861220b84705b564ae03212b4f8c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946310, "uuid": "0a9d0f84-b18d-4e6f-98a1-4648fbd9dfcd", "comment": "Malware payload", "value": "0b31fac91ae8caf5ec78874888990a7358fb3848613e5692382ce4dfba87d6f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946310, "uuid": "d3a229a6-2720-4c32-a403-55733f4a40fb", "comment": "Malware payload", "value": "bfe6ef4d6fd4df2486548ab922ac64dcdd5d3201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946310, "uuid": "30671b90-54dd-4102-a33d-53e168ac8744", "comment": "Malware payload", "value": "424b51803a324f22905ab4c08a029c031ff2c38ba3d83bbd1545ecdc90bf80737bafb9f9af8c140e392219224ef06222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946310, "uuid": "3008a73c-a65a-49f8-ab2b-9c786e321d44", "value": "T1FCB512E31FD70E42A99AAEB16E1C206D444BD40538F9C02C7527CFEB7E1A4E88D75D26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946310, "uuid": "f05d8972-5081-49e4-9988-984062ef21c1", "value": "96:B5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5Ek5EB:kKobbsjbXuO3BtIsGaa+PTPTzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783946310, "uuid": "ced5f25b-9d69-49c6-b0d5-76491a50bc0d", "value": 2491199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783946310, "uuid": "ac5b0c5f-b682-4ac6-a7bf-75ed4c956cde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946310, "uuid": "ebf3278a-244f-4377-a429-3c625b850bb0", "value": "Factura de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc27fee7-7eda-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783961388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961388, "uuid": "641fc030-84d8-40ea-af0f-9492917b39fd", "comment": "Malware payload (RemusStealer)", "value": "59f3b6de966851ff1c36a9b4d76ef00f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961388, "uuid": "9a9a55a3-91d0-4b18-a6df-170da949d596", "comment": "Malware payload (RemusStealer)", "value": "0b845b890586407658a6bfcb1030b32be641760120e304bdf372a835ca5d77a4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961388, "uuid": "f8e8035b-95b4-452c-960e-85e345e387f5", "comment": "Malware payload (RemusStealer)", "value": "db9ea25ecd1d6f99e637973526c29a57ed153127", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961388, "uuid": "d347abac-20e7-4d58-b4e5-da65644edc70", "comment": "Malware payload (RemusStealer)", "value": "f6f551ababd24485aabd12bb5b4d9e86ca1e7b61fa9f727fed7e7cf02f46ed5d061c69f98013edfb5be3d63161efa898", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961388, "uuid": "b18279ce-dd51-40f9-8f65-c296ed05ac8d", "value": "T178A55B077CD148E9D4AA673288B661927B35BC080F3A27D72E90B7782F727D19D36B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961388, "uuid": "43d1e512-81b7-4237-88d7-d547935af487", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961388, "uuid": "eda76c7b-214d-498e-888f-6fe1b1a02387", "value": "24576:VbeEuvkgCyw0SN7PQXbsqn8zUPs1MUIzpoZxdinp6ytxzBele5rK2yyx3fzBW:VbePvLCylK7oww8LySZxQnp3IAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783961388, "uuid": "766ae660-1495-4ce8-97e2-1b9db02416ae", "value": 2227112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783961388, "uuid": "658420c3-687d-4266-a976-856e10eedd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961388, "uuid": "8c7cd963-f3ea-4cd5-9f5d-f789eb1eaad5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170e543f-7eb1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783943448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943448, "uuid": "b939b1e4-2dd8-460f-993d-646b0bba4f8e", "comment": "Malware payload", "value": "2773b36a56367399690cd28f348d1533", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943448, "uuid": "2ee3dff6-17e0-4e72-a025-cf65e06db9a0", "comment": "Malware payload", "value": "0c05628e96568f16fde7b891006b20d630c469153f229a1ee1d5a05eeec72c2f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943448, "uuid": "029f489c-a649-4eca-acd5-664cd742adb9", "comment": "Malware payload", "value": "84e2b2760c19580a44ce1c8df05a91d65a87a2af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943448, "uuid": "cbc13df3-6342-497c-a722-7842ee9c0931", "comment": "Malware payload", "value": "c770a6be40486d9982fa4e7d18c4b014203cbf926278fa6352878db941376741893937cdb792a7cd4e7d60de99491a0f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943448, "uuid": "734f28bb-7b5b-466c-804c-0ea47305251d", "value": "T1F8235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9D920961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943448, "uuid": "670b6e0c-b458-4356-9b18-b5a349a6fc43", "value": "768:ZJFWzZx5J9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:jkzIcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783943448, "uuid": "ab11a7af-9ce6-40b5-b5aa-88c0d0c00318", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783943448, "uuid": "8c468a59-cb23-4a0e-99fe-e7a042590092", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943448, "uuid": "4db9080a-cb76-4595-b420-e3d0d35e8d2d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252ee9b9-7f16-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783986851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986851, "uuid": "3671b13b-1672-4bc3-8a9b-d28b11540936", "comment": "Malware payload", "value": "22bdb9487166406910bb579d6e579c85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986851, "uuid": "1b568b37-e550-4dfa-892e-277861c909e5", "comment": "Malware payload", "value": "0d68f94463f8fa351000dfcd3c7188f18d3819aef2d5cf6022e9bf3154d0fcf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986851, "uuid": "0db69bd4-987a-4b5a-9180-a1f50cff2f4a", "comment": "Malware payload", "value": "eba43b390a02a9d3c0527c0fe94c04aae2e7387c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986851, "uuid": "42a26725-4d65-4a10-9378-2728460728aa", "comment": "Malware payload", "value": "443b2b4f0c2291d7e1b4d73f696ee71782e552d8b66a030b3f31043b606060ca70107bbda010a470ff3578140a6dc68e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986851, "uuid": "0dd96fbc-c571-4cd4-a0af-48cc786c5421", "value": "T1EC647EE3FC01E9BFFC6ED332CC174A04B134E31154921A3A62A37779A92B1595973E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986851, "uuid": "24c3386c-015a-4143-95db-0dbb950e9908", "value": "6144:xcztYdmgkJEhCvBofz9hiFs0U5Tyt5zTh8Ks+XlLdsBC:xat9pvBofz9hiFs04KNsBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783986851, "uuid": "a9ac659b-83d2-46dd-a805-82afeba5e1b6", "value": 328428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783986851, "uuid": "ab4fe1c4-7a73-4ed3-b153-de8b967d4f82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986851, "uuid": "8d1a283a-83be-4bba-8cbd-5d7d07d02b28", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30ecb7d-7ecd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783955709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955709, "uuid": "f3c981f6-8584-42f4-8258-4dd2a518b9a8", "comment": "Malware payload (WannaCry)", "value": "4af1d2af508abef8bfc77dafa3b80444", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955709, "uuid": "85964e9b-e272-4fb7-9d4e-325a81a298a0", "comment": "Malware payload (WannaCry)", "value": "0fa477cedacdea2e1782414d0568b7b5e83e86ccb827710a724448e43bbf6a09", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955709, "uuid": "629bc727-d9e9-417f-bd9b-7ef3309b3f87", "comment": "Malware payload (WannaCry)", "value": "6755f01a7afcc38ab77aff560b0c905e4dc7d7df", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955709, "uuid": "a55e524e-d92e-41ef-a31f-45dad64447e4", "comment": "Malware payload (WannaCry)", "value": "dea8668d6f92085893f688f54613930e932bd7c545bf0078daf0dc6c55670d8a58fd8d4b9264f71c70ef3f79e57bc1ef", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955709, "uuid": "20056771-1b52-48eb-bc44-68780c7dce66", "value": "T109363364632C91BCE166067084B38D38E7777C62633E871F87A4C7560E137A7BB64B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955709, "uuid": "50d082ef-8c15-47ad-a4c3-68d0b42f8a58", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955709, "uuid": "12fff314-590f-4669-a4ed-728239295adf", "value": "49152:jnYnjQqMSPbcBV6hnvxJM0H9PAMEcaEau3R8:DI8qPoB0hvxWa9P593R8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783955709, "uuid": "7c94dc3b-2daa-4b92-b17e-8cb7502c6e1b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783955709, "uuid": "42203d51-62de-4dc7-88be-68be62f01a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955709, "uuid": "9e896737-f69d-435e-9050-451430cbea3c", "value": "0fa477cedacdea2e1782414d0568b7b5e83e86ccb827710a724448e43bbf6a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643c9671-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783906211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906211, "uuid": "f03956fa-3940-4e69-a410-482da7b72936", "comment": "Malware payload (ValleyRAT)", "value": "13931954f080312b5b4df53c5ca8eb7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906211, "uuid": "ecbfa43e-f96c-42b7-b2df-e30c7e97a1f6", "comment": "Malware payload (ValleyRAT)", "value": "0fbe935d932ce6849224d77e3f32bdfd49910e5a34741ceab81ca8230d92a9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906211, "uuid": "3063a64e-88a5-41e6-a539-fb3b5a616197", "comment": "Malware payload (ValleyRAT)", "value": "23e9590ab99ce9d2c653cb044aaf8390908548c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906211, "uuid": "8cf2acd0-7b2a-4384-9c7b-d07c10415a33", "comment": "Malware payload (ValleyRAT)", "value": "c905881926ade05769b7f47ee77be227fb1767140c2908f893e2c7b163ba163a0cfda1d379d34754677f2d6c48300e08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906211, "uuid": "63b7e8dd-061c-4536-b8bf-5cfc623b566f", "value": "T194937D0274D1C871F5B6143558B4EEA18A3EF8501F149EEB3798177E0F346C1AA36EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906211, "uuid": "065dab8d-88db-423c-9c84-6ba4f49e60dd", "value": "ee8e50343b053c670ed20dfccbcd29fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906211, "uuid": "c10f378d-f434-4c44-9e7b-6ecdf9d97b14", "value": "1536:anwwgs7tJ8RNOKIpQj9FVjJDf4OoNdb+H8k8Gf/qqkB0asW4ltcdxipFp1wJQH:anp7t4rIpQJjJDfwdb+HT8Gf/SBY8xch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906211, "uuid": "8ec2ea30-eda8-466b-b6a9-15576a491b19", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906211, "uuid": "08ed9bf3-b713-4cbf-8ba4-0d676987b1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906211, "uuid": "ab025e7c-431d-4cd5-aa55-923a360e13d0", "value": "13931954f080312b5b4df53c5ca8eb7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a05cd6-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963369, "uuid": "c4395f44-6d42-48b1-a002-1f95b3d3e7bd", "comment": "Malware payload", "value": "d2a6bf358e97223edcbbc6f79b0507e5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963369, "uuid": "734aa6bb-5bda-4929-b668-ef10c691d959", "comment": "Malware payload", "value": "1164aa2fd96db37151aaf75eda4651078651791b82a21322b8849f2c62a7897f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963369, "uuid": "d67771f3-5554-4fef-b189-4ded2e151b7e", "comment": "Malware payload", "value": "dcf27df4734ea53f733835f40973c4a2b06d115d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963369, "uuid": "f48b2ea9-74b3-4887-b9c6-48d4cb86e932", "comment": "Malware payload", "value": "98fbe6eadb4b6a080406c65750c3f99a0ed8d4da997010c125c8fb7ea153a8fa0ce250c56641c69cf5d45168e7e6260f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963369, "uuid": "3efdf541-255a-43f0-baed-f5100363399b", "value": "T14B32FB8C4480929066FF5A24796C428CBBECB9D6A98179507D1F7CB3B3B412FC1FD968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963369, "uuid": "c76c5706-fbe5-4be2-bd48-8719ebb191b9", "value": "192:FpTa4/uCBuFxiVeuzutsuVu/uXbuVuF0mNj/u8pSbDQt/5K6Zeiiciqhwk:F4k5ISJ4sGb4E/f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963369, "uuid": "eee4a7c3-31ee-4d42-81f0-f45f54fc7a8c", "value": 11514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963369, "uuid": "d08db903-4fe6-4fa4-a4e3-354e509b89ad", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963369, "uuid": "2416719a-3e9f-4336-b476-3c30a0ceaf08", "value": "goodthingsarecoming.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7619edb7-7e5d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783907530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783907530, "uuid": "7ea2f53b-a561-4758-ab48-4d6ed799805f", "comment": "Malware payload (Efimer)", "value": "901c4fcf11b2620486cb424fc990725f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783907530, "uuid": "3c1bfdb2-6b22-4f5f-a03b-0ef12c1864cb", "comment": "Malware payload (Efimer)", "value": "1317a25d33bcffbc35db0e23afd20b5c5328fdff33c1c929236882856d9c7577", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783907530, "uuid": "320b7290-615b-4074-bf4c-846a14b331eb", "comment": "Malware payload (Efimer)", "value": "0c1927b3ae832189caffd16a04c4b09592ce9af3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783907530, "uuid": "30dd49d7-6b88-41a6-8ba1-a7833a3f629c", "comment": "Malware payload (Efimer)", "value": "2c1f4c02c57dc3bcfd5f1b9fb0517a78987ba022342cc4d817a20eaa75c6330bcfec30f73d95452b4f8b95393d853861", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783907530, "uuid": "49b24db7-6331-45de-8854-1d623b6c8ac0", "value": "T1CBE6334CA7C015FEFAB30138BDD2529BD8E978694B31C9DB935856A09E672E14C3CB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783907530, "uuid": "ba1836c7-fe9a-467c-8f67-ba58af3e0ace", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783907530, "uuid": "61650c39-73e7-48bc-adc0-8d8ccadebbb2", "value": "393216:R7Teso+ev4HfprMxhBUjtlaXMCHWUjXDcuI3/PGTAI:RNn64HJMw2XMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783907530, "uuid": "13c8220d-c4ea-48c0-ac66-8bcfc1023c3d", "value": 14305588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783907530, "uuid": "49bacbd5-16db-48a3-a3f2-f324c3d5b54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783907530, "uuid": "c0a6f80f-e17c-4893-86b5-431017ee5d4f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b54a175-7edb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RevStealer)", "timestamp": 1783961602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961602, "uuid": "38b0855a-2698-46b8-92a9-bd6aeb56e2b2", "comment": "Malware payload (RevStealer)", "value": "0d94dce53e366d59eab5fab317200715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961602, "uuid": "74e61188-07f1-40e2-ae7c-88fdafc8dd2c", "comment": "Malware payload (RevStealer)", "value": "13543ef85a0988a09ef430a1f114f920a670a82f9e360ff9e6872252062d4768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961602, "uuid": "41849ebd-e632-4aae-a861-8b0a79a47d50", "comment": "Malware payload (RevStealer)", "value": "238dbcf748bd82028fa30f8c1b033a9016f7de1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961602, "uuid": "a8f5aa29-932d-45d6-8f31-7dd59113fc28", "comment": "Malware payload (RevStealer)", "value": "aa772e3da6511e02767d4fb1c06a8799bfc1cdf58b45ec6d5bb68fc1f126f13dd9f6390ab041af63af9227744ac7855c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961602, "uuid": "5a16646f-1c37-4a08-a1ad-eacd99f1ff40", "value": "T199747C69B3540C71F56BE178DD869373F3B6B40583A4E39B57B06A663FA3222B12D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961602, "uuid": "39a46602-45d6-456d-a2a1-e3becb77ce1a", "value": "3719afba1f7a354c3f80c30a32335d39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961602, "uuid": "9ae0a112-4d51-4385-a439-ce40a12a3d59", "value": "6144:9mjSTEl8eY6A3K/Ta6pSaDgtRYHTYLjgHtg/jj9WRue:8CEl8X3QTa6waDgtRnYtOEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783961602, "uuid": "566a52d7-03b8-42b4-a0a3-2a5f1a01ff4c", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783961602, "uuid": "c4e61714-8e55-4460-a19c-0111011d0164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961602, "uuid": "6999a108-9e7f-47de-9682-b1dce21de994", "value": "13543ef85a0988a09ef430a1f114f920a670a82f9e360ff9e6872252062d4768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04fd2f9-7eeb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783968643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968643, "uuid": "ca0de0a1-b2fb-4ce9-a765-446286bb571a", "comment": "Malware payload", "value": "d337f572afd9f3de1a5786d1dd90366d", "object_relation": "md5", "Tag": [ { "name": "AES-loader", "colour": "#BF82E9", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "pyAdmin2", "colour": "#E6D71F", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "pyw", "colour": "#281BA4", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968643, "uuid": "3cbbdcc5-6206-418e-926f-55fa50c6bb35", "comment": "Malware payload", "value": "1528fbea80a84107c096ea816c078b98150a36a2f1735772b6544e0fad063849", "object_relation": "sha256", "Tag": [ { "name": "AES-loader", "colour": "#BF82E9", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "pyAdmin2", "colour": "#E6D71F", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "pyw", "colour": "#281BA4", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968643, "uuid": "fc600d3c-dfb9-49a1-a39a-e5372d59f095", "comment": "Malware payload", "value": "23e2939ee1c36ee56d205793fc9a7c7ff84384a1", "object_relation": "sha1", "Tag": [ { "name": "AES-loader", "colour": "#BF82E9", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "pyAdmin2", "colour": "#E6D71F", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "pyw", "colour": "#281BA4", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968643, "uuid": "34d6027d-efc8-40e8-b891-29feb62319ca", "comment": "Malware payload", "value": "20572fd5cfd2ac43fd172958a80e4edf831d92af16cd57de138108674f532b0aefeeb0ad36cf4f04ed620aee88067d53", "object_relation": "sha3-384", "Tag": [ { "name": "AES-loader", "colour": "#BF82E9", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "pyAdmin2", "colour": "#E6D71F", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "pyw", "colour": "#281BA4", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968643, "uuid": "e3429a97-8322-493b-9b34-5c98f1d6b3ca", "value": "T1B0B42308BFF50DBAC30857A8719FA68D8BA70D1016E4BE9716C1A5479BB9F4BC03361D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968643, "uuid": "89d69ac2-e01f-4d38-9360-fb457eff2383", "value": "12288:bwD5oFeQCtz1oCv2I5YaU6c1gXJRkxPrMKF:09RJ2Oxd5KjMKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783968643, "uuid": "468081b5-1cae-494e-90b7-a75e9bf43b4f", "value": 518325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783968643, "uuid": "e3c07c71-dd17-46a1-9be8-734eb242bb37", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968643, "uuid": "f31c6144-810d-4858-b0b6-7aac91941592", "value": "full_aes.pyw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba1017a-7f01-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783978030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978030, "uuid": "aad9181d-77e0-485b-bb79-8750d8b677c4", "comment": "Malware payload (RemusStealer)", "value": "811f014bacdcbb056db397f13d528405", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8121", "colour": "#BF0740", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978030, "uuid": "f3bc092d-548a-47f5-86ff-ea504bbf5198", "comment": "Malware payload (RemusStealer)", "value": "16a1260ae199d83c537b65ca558b33c7a783d28c5547b5fcb35dee4cceb5f12e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8121", "colour": "#BF0740", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978030, "uuid": "5fba407f-649c-4c3a-a928-5fd27a12995c", "comment": "Malware payload (RemusStealer)", "value": "3cd8a6d94465a9e266f9869051bf7df2316069bf", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8121", "colour": "#BF0740", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978030, "uuid": "a4e8c239-a9b5-45a7-8435-eccc507c88b6", "comment": "Malware payload (RemusStealer)", "value": "669ac66520a36381aedc48524cf301aea879c5e0d86d7f902a1d78980ad0f6e46378e288717f5db9450ad9a023ffc459", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8121", "colour": "#BF0740", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978030, "uuid": "eff57600-f2e7-454e-ac4c-317992589dae", "value": "T17C0733DFA7CCA6823251FDC10DAE118771904F7FDE24F687ED505276099D0BAB2D8A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978030, "uuid": "b51c2c57-91be-41a4-ba7f-27dafbe1ed75", "value": "393216:9FZk52cpSFRZh9UHaMFD+nl2nnVT0nFTdBN+ym:uppSFxnnoVTQV9+ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783978030, "uuid": "16623674-556a-4512-ad9d-b815736f9737", "value": 17857891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783978030, "uuid": "ae2acb94-0a59-4060-a154-9269f2445ce4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978030, "uuid": "5e767389-c07b-48eb-b49a-e40a1236067b", "value": "jee chahta hai movie 720p download utorrent movies.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d05f0ee-7ee7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783966705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966705, "uuid": "3f4bb358-b6c7-4691-98f7-546ab9fea5a8", "comment": "Malware payload", "value": "b23376e0511c920e54199a577acbde4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966705, "uuid": "3ea62fc1-c081-4cc1-8f83-793a2cce4223", "comment": "Malware payload", "value": "179042e8ce848a0da871bc39c08f63285971d5c3470dc06fcb987f324d564d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966705, "uuid": "0cd765ef-61bc-4f32-ba4b-67760371ff97", "comment": "Malware payload", "value": "c5abb30c93f75efe4ab93cb515d2f59993a76833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966705, "uuid": "d9a6d402-b15c-48e9-9b5a-538e92f36919", "comment": "Malware payload", "value": "d1c25b6a7d7fc4e56e515f130a929a133b0fad9e3a7133468bb5ec55831e72b554a699c87917becbc792722680ad6824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966705, "uuid": "dc936142-1c68-43c3-a5eb-646006143e7a", "value": "T19F08330851A5C15BC05ACFB1B4F3642152D88DABE1F42DD6E3540A3DB4FEA8860EDB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966705, "uuid": "a98a1a8a-4e13-4073-ad34-c0b3a6fc5a6b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966705, "uuid": "97185b30-db3a-44bd-ad99-4916ba587af4", "value": "1572864:Ct9IKPNwmgsdm42sKrRWYi9oH61M3E3ATXemPC7tssiT0EHN9lRFrZSA7:CUKmmgsn2sKrRWr9oHEUE+umP4WZz6A7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783966705, "uuid": "02737962-32ae-4e3a-9ca2-5e2dfea3412c", "value": 82788330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783966705, "uuid": "df3e3f23-0e26-4ed3-8d32-ed5fedf37a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966705, "uuid": "8cad5451-b4e9-4ac3-9bc7-ad4990426c99", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712992fd-7e85-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783924701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783924701, "uuid": "0514aa95-2209-4c85-9e2a-4fd6bc58a9d1", "comment": "Malware payload (Mirai)", "value": "fee923b1f363e2c4329b12a1de0db9f8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783924701, "uuid": "7eb7ad73-e6e7-4d3d-a1d7-81fea99a6587", "comment": "Malware payload (Mirai)", "value": "17c8c181a50b06ed7bb2d7a43677ba41ef16efd11b95c561eb8e8973ed16d0f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783924701, "uuid": "5721aafe-2324-4ca1-94de-6636a097d438", "comment": "Malware payload (Mirai)", "value": "8ca4e7da24efc631ec0b33a79c7226885b317864", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783924701, "uuid": "e6ba4237-37ec-4356-a904-9fd4ea32c00b", "comment": "Malware payload (Mirai)", "value": "994bea63bfafc3758fbef61fb2c55751fe8b22c091608fca7d7fc1f3d63d601c49704f1d06d7c99403539e7c95229467", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783924701, "uuid": "6285d551-ca16-44d7-a935-33acc72ca92a", "value": "T12521F69CE99AB2D2AFBDCD50F0A20315B506A3C632734E2EEC4634306CACA40B530F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783924701, "uuid": "1c44da35-3ad5-486a-8697-9d8460a28276", "value": "12:QvWXOp3dKU2hCUKAMzhKdqxwJI60ax/KO0LK7PzlkNaKSvZ6+qaGuh/K+M0LK7+M:QvQhBh9M0oymQxiFKvsF0ZXVioKAbF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783924701, "uuid": "482870fa-edf3-4e73-86ed-2ed20351cf8d", "value": 1321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783924701, "uuid": "36a9d548-a1f7-48c3-8a29-3d5559879f1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783924701, "uuid": "9a74f647-6bbd-43b0-a54d-b6ddfd464c2c", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c661af5-7ee0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963670, "uuid": "255f13da-e1cb-48c7-b42e-fd60c579db34", "comment": "Malware payload", "value": "0f879bf0f9c07a77d686349a7a96e200", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963670, "uuid": "e26230da-d9e0-4330-9cf6-495f89f98d00", "comment": "Malware payload", "value": "18137cc5c46f213ae4b41442b6836119cd098edbe4c80bb18362a9bc79c1d83a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963670, "uuid": "c359c6c5-2fc0-4402-8f08-ffbbc202281d", "comment": "Malware payload", "value": "fae3be735e2cd11d414c8a2eafa8c6c43b313c78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963670, "uuid": "a8306a27-3b4c-4882-a64e-4bafd98b97af", "comment": "Malware payload", "value": "11c9108d54f16f6065096e2733e65d0f6efa0084cdbc5b060f1317abe21b480bb0e61634b6ad4fa2fab924def7688a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963670, "uuid": "5fdc3874-6792-4413-a090-92c1049db42d", "value": "T11EA312CBF8E45D56C12AD17107EDF507E18FB80CA987AA2764C94BE8868D63274313EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963670, "uuid": "757cf237-3da3-4780-ad96-3d5857b7d372", "value": "3072:dlg2oKbu09hdIhLcmysADurVR1fSZXdy1aoutX:ng2oeHndktAepfoAaoSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963670, "uuid": "61d62aae-591e-4d1c-859c-a6ce140f6ca4", "value": 103968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963670, "uuid": "502c6ab4-f23c-4f95-8f34-ee422620a255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963670, "uuid": "451fec36-599f-4ee8-ad83-0268baac38bb", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb081798-7ebe-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783949414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783949414, "uuid": "25318357-7b56-4f06-8f7e-b63bffe3e03d", "comment": "Malware payload", "value": "5e2ae4a5a13ed996af3277276e6a2ca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783949414, "uuid": "b5a7163c-94a6-47f3-8449-eea8a0d877b0", "comment": "Malware payload", "value": "1ae7b00337c85270ab8c44dac3b35ce988e6aa5a92ac17ea9b3310b15e802e80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783949414, "uuid": "6a2331fb-2044-408d-93e1-0a40aaeed944", "comment": "Malware payload", "value": "8a2229ab022e7fd418feca09faecac3b670d6fca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783949414, "uuid": "6e6df6cc-3fbf-4bbd-a728-64eb98e07750", "comment": "Malware payload", "value": "9f7c776b9183d8d414f7dc5ff93728e91289797c4ece8d0fa5096df2e85f032ad2e37ebf0b8e526996721a1752ea57a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783949414, "uuid": "bf34eedb-570a-4cc5-927d-1330d910640f", "value": "T10E563B73A49154D4D2EAD974C6156213BEE4388B273463CBBBC076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783949414, "uuid": "84f26d0f-7d50-41a6-9513-652a63783d5d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQl:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783949414, "uuid": "bf50334f-fef0-4d0a-90ea-dbf1161871b7", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783949414, "uuid": "128b9213-c5fe-4dda-9bf1-f8f025644c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783949414, "uuid": "136f6c87-77ab-4944-ba57-eda47835ab79", "value": "1ae7b00337c85270ab8c44dac3b35ce988e6aa5a92ac17ea9b3310b15e802e80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45e3cbd-7e88-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783926076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926076, "uuid": "949673f4-c1b4-48cb-ab36-97b6272fcffa", "comment": "Malware payload", "value": "f8c8710400062394bfea57c581e725f9", "object_relation": "md5", "Tag": [ { "name": "185-174-135-156", "colour": "#AA3699", "exportable": true, "hide_tag": false }, { "name": "87-120-104-88", "colour": "#12C164", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "node54group-com", "colour": "#ED301B", "exportable": true, "hide_tag": false }, { "name": "node66group-pro", "colour": "#618B9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926076, "uuid": "0e76f80f-42b5-40d5-a8f4-2f80073bd96b", "comment": "Malware payload", "value": "1b80d81281eb52ef68281d939651abc569ff261a1f4b980d53d541e56e4fa717", "object_relation": "sha256", "Tag": [ { "name": "185-174-135-156", "colour": "#AA3699", "exportable": true, "hide_tag": false }, { "name": "87-120-104-88", "colour": "#12C164", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "node54group-com", "colour": "#ED301B", "exportable": true, "hide_tag": false }, { "name": "node66group-pro", "colour": "#618B9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926076, "uuid": "9c493b42-5e07-4a4c-be65-d89d904779d0", "comment": "Malware payload", "value": "bab9eb607aa2c3992ae5daf34554c866e3b99985", "object_relation": "sha1", "Tag": [ { "name": "185-174-135-156", "colour": "#AA3699", "exportable": true, "hide_tag": false }, { "name": "87-120-104-88", "colour": "#12C164", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "node54group-com", "colour": "#ED301B", "exportable": true, "hide_tag": false }, { "name": "node66group-pro", "colour": "#618B9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926076, "uuid": "e2a1affc-e077-4f32-9ec0-8ae333d71c06", "comment": "Malware payload", "value": "9fb56ad9700fe5b30531f7fb9922391cce261e3161e3cc6b793529217c12a9fe9092e63b9423704f2297734e1f5bcc17", "object_relation": "sha3-384", "Tag": [ { "name": "185-174-135-156", "colour": "#AA3699", "exportable": true, "hide_tag": false }, { "name": "87-120-104-88", "colour": "#12C164", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "node54group-com", "colour": "#ED301B", "exportable": true, "hide_tag": false }, { "name": "node66group-pro", "colour": "#618B9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926076, "uuid": "6feca3be-def3-4d51-9026-e20ea143703f", "value": "T1F9029E0EDBC44CC2E1DFF67556908151C926EBC48AEB00095AF962D9BB81FB75331271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926076, "uuid": "3edd2f97-7b19-43da-8a6c-3c23ded26c21", "value": "192:mRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+C:mRm/wksuQJ/g6dI+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926076, "uuid": "cc872043-9a9b-4ba8-8376-958864880e04", "value": 9011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926076, "uuid": "739a9044-f922-41d5-8d1a-e14f48780a5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926076, "uuid": "3c06e8a9-2eef-4f29-8950-91022282c6cc", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e366d4-7e51-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783902436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783902436, "uuid": "d83fd6e8-1770-4fe5-a647-385ab6331558", "comment": "Malware payload", "value": "9874382b087411b023addcd6496789a3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783902436, "uuid": "f9fb8ec8-7577-42e1-8dd1-dbef29f83553", "comment": "Malware payload", "value": "1c62a0417a9b2f702406bd46e87aed1d3f432ef2e2a0ad7b922d55f8bfe79f6c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783902436, "uuid": "e26dcbad-f545-48e8-9f56-d4bcf85c634a", "comment": "Malware payload", "value": "1169dfef4a173dc66d1ff3b177b96b222d4d9035", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783902436, "uuid": "07f8d0ad-a339-4650-acbb-697a2398ee2d", "comment": "Malware payload", "value": "067f4f4d7540090826a9e3b50d1497902f65ae486e655fdac898ee22d50e07750cb315de0b4cfa6b18b3aef6074f08d8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783902436, "uuid": "55e1f0f1-ca41-41af-bee4-b13d84684058", "value": "T12C236C6516857C14AE98C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6ADA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783902436, "uuid": "169b8275-f409-4205-ae53-adeb1030c252", "value": "768:nr9NyXsZztCh9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:rHusZ7cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783902436, "uuid": "5b3c9a05-c1a4-440f-a403-2b890d5560b7", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783902436, "uuid": "56e29d8a-3e1b-44d5-8af4-dc3933adf7be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783902436, "uuid": "67593919-e962-49ca-ac27-d930f4c18055", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c9a455-7eb2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783944057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944057, "uuid": "e3446440-0e8b-4c5e-8088-b333523aa51b", "comment": "Malware payload (ValleyRAT)", "value": "0a9429738e11acea24949b0247b31ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944057, "uuid": "d815f9f4-d8aa-4b99-aea3-1037cd13baca", "comment": "Malware payload (ValleyRAT)", "value": "1c82635c29f40e971971e150ebee6f36dabdd2a156f51214f20425315abb413f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944057, "uuid": "0c67b288-57cd-40fa-9875-2afb2ae2b262", "comment": "Malware payload (ValleyRAT)", "value": "6a08b69f2d8b331b829365e91611f201898817a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944057, "uuid": "7233759e-e3ed-46f4-beaa-d600ff75ab45", "comment": "Malware payload (ValleyRAT)", "value": "f38f524abd05adb0752cb905c619d0e8d0517a9ddde45cbc5bc5ad59088ba4f0b1010d4478789f967adbfa4441b3de05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944057, "uuid": "f9e0a120-d6f4-4de7-b9ba-6e0c912aa9f0", "value": "T1AA26B0B876047DE6E67F467BCA96ACD9137636638B8BA4CE40A477C30963371FE11804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944057, "uuid": "cfa8a325-f7aa-46be-bed3-db011f917bca", "value": "f1fd9dd3fee3797a6e7e6e1c2caa6dee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944057, "uuid": "7a746df8-0e33-4b51-b5ac-bad757047477", "value": "24576:MoqhRH0AMHUX6f3yssW0UK44jUM2DJ+laZgIr79ja8YK+bXlX6l0zI4b3z8ABMVx:MoU9xMHeTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783944057, "uuid": "0cb281cb-5a61-4d49-be24-87edafc0657c", "value": 4564192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783944057, "uuid": "eee77e5d-b998-4a4f-bf28-3baa4de6bd0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944057, "uuid": "11ddca4c-9902-479a-acde-f7c7913b0a4b", "value": "Runtime_x64_1512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65394aa7-7ef0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783970638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970638, "uuid": "c69f6507-ce55-4808-b2c8-26e5e968cb3f", "comment": "Malware payload", "value": "5344f49920d27358cf85af76ed438bd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970638, "uuid": "8ad6a3e0-04fc-4177-a2db-ff63b56f4c60", "comment": "Malware payload", "value": "1caafa7cb71ac8506fae18f174afbe3594c47d18a5a1f2976b16abf0191f5c1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970638, "uuid": "27ae80d9-41f6-4722-990e-6168b2ae7967", "comment": "Malware payload", "value": "545eb952dfad2fc7b85e8f00e4ed5edd1d28821f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970638, "uuid": "2261275e-6667-42a6-b854-cec47770acac", "comment": "Malware payload", "value": "2cd2096d5889dbdfe486410b3b18445754c341a55162fb5483c2c2022d59fedd27139b914815eb62d0c905089a94a6ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970638, "uuid": "8bacf62c-d075-4bd2-b6c3-2f966a33a437", "value": "T131C312848A2D95F881CB66B5301D1336554C61D1770A632F7BE28EC263747DBFA0CDAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970638, "uuid": "092e3a11-1040-4563-9e23-4fd1720bdf81", "value": "1536:V6hcH3oye3ACx1oMA+wZIUGxho8cIGVFih5/TCFUgXut5tCO2i76tFjoNcqeFt0Y:V6hJH3Pc4g1VFizEUGK5t7L6jB0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783970638, "uuid": "db36f7cb-da32-4be4-ab01-29b9cccf66c3", "value": 124148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783970638, "uuid": "9bfc5ae5-a044-4690-8242-8e4174fe0ae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970638, "uuid": "fef28fea-cc83-4a4a-b4bf-981040418a3d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8498f887-7eef-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783970261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970261, "uuid": "096e1da4-1042-4b4b-bcd5-319aa4c2a9e8", "comment": "Malware payload", "value": "5bcb2d9fed62f007d35999ceb884a7a7", "object_relation": "md5", "Tag": [ { "name": "curl-t-com", "colour": "#57965D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970261, "uuid": "091bca5b-fe46-48f5-a98e-0377c4f88ae9", "comment": "Malware payload", "value": "1d08b5a056f3e2d966fcadda088946c760f69b30cb578be619abddc27803c7e8", "object_relation": "sha256", "Tag": [ { "name": "curl-t-com", "colour": "#57965D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970261, "uuid": "62d039bb-578f-415a-abd2-4ff195f4cee5", "comment": "Malware payload", "value": "3d9e727e26c450913785d74ca3c534f2cf1019da", "object_relation": "sha1", "Tag": [ { "name": "curl-t-com", "colour": "#57965D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970261, "uuid": "532eba7a-7c9e-4bcb-8f8f-dcbcc05c471f", "comment": "Malware payload", "value": "907fe74e2bb9a4c055d1d0883699eaaa7f75ef59e3e4a8dc73fc09b4bb14c510c84b84ee943f78c353f5d53d452b0118", "object_relation": "sha3-384", "Tag": [ { "name": "curl-t-com", "colour": "#57965D", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970261, "uuid": "7faf2fb0-9c51-4fce-9b90-edfd24a0e688", "value": "T145B57C03E69580BDC06BC170875B9773FA31F8490234BA5F6798DB212F25FA09B2E759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970261, "uuid": "dea307f4-cf9c-4572-a995-a46d399707d5", "value": "49152:70uLZnkcL/tZPhoR6WpCQAQlx1QBPfkkNWPZs1qXLVVzCdf:7vrPQSBX4Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783970261, "uuid": "28d4992f-9c43-462d-83d4-642b176fc3cc", "value": 2396160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783970261, "uuid": "5cea6024-639d-48f1-925a-3931d0d55897", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970261, "uuid": "3af37c9d-11a2-4108-90fd-76eb6f75b7b9", "value": "bundle.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3e44de-7e4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783901447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901447, "uuid": "a9bf2438-ec9d-40c0-a507-966dc8dd08be", "comment": "Malware payload", "value": "3e2923e53eb5fb2d0e614b89d28924ed", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901447, "uuid": "58206eee-2cac-4740-8574-3a728362b0c0", "comment": "Malware payload", "value": "1d55f1f5d777b3eda5e96df1b1dbb9713479808f05d00057a73bbfdb03637b58", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901447, "uuid": "f6f84c75-3899-455c-adf8-f40be7886447", "comment": "Malware payload", "value": "ea6140645b8fa5245b204912a8b432355cd6fd0a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901447, "uuid": "91948601-2dfd-4dbc-b2bf-680980c2644e", "comment": "Malware payload", "value": "9f2bc151c9f46e725efb73c55b226daddf6edf816a4ce86ade96552cda87a71573072f2653889c9423809db9ae2e8f90", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901447, "uuid": "4b1aea87-124c-4451-8197-8341308cd0f1", "value": "T1731106DE5A219ACC4D428A89797046C4D99E83C1FCA3CF0DA9E1456B20BC3653A6DF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901447, "uuid": "622aa0a6-b275-4ecb-8fd0-21bf513c5beb", "value": "24:HEUlUb8LWJauyW40LNCpgRkU89A3+22MoKvg5ro9xC6:kUoJauyW40LNCpgRkU89A3+2zoNkXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783901447, "uuid": "c5a60031-2d38-41eb-94e8-90a5361cd819", "value": 1038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783901447, "uuid": "57cfa701-84bf-4723-8981-57018b0f92f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901447, "uuid": "2a40c444-e3fc-46e8-839c-56fa3fc97ef6", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f545c66-7e55-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783904109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904109, "uuid": "bb826bb3-c79a-4d08-99c3-fadcefecabe9", "comment": "Malware payload (Vidar)", "value": "26aa06f7c7609ba04e3ff3ff25ee46ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904109, "uuid": "fb09f36b-4d30-4b4c-946f-3ba1b0ebb1dd", "comment": "Malware payload (Vidar)", "value": "1e13c2c9eac72daf63fd00a9946878949e159ae6ec51b54ec64f942d79d61913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904109, "uuid": "1ae340b8-26ca-493b-87e0-4222bd977eca", "comment": "Malware payload (Vidar)", "value": "ad69c3ce50248510e585c81fb06d4629cc419cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904109, "uuid": "920662c7-1105-43f5-93f8-3114a0fa6b9e", "comment": "Malware payload (Vidar)", "value": "835b1739cc2c70d880791b593739ab9335817bc53bcfcbd921a3dc0a6b9e5d4ec58b09b4fd2afe82281878db441c83a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904109, "uuid": "65667a91-b7a0-4417-a30c-1bdceb462115", "value": "T1BEF57C06BCA549E6C0AEB33289B35192BB35BC181B3527D72E90B7782F727D19C36714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904109, "uuid": "d92fc12d-c0a9-4214-8150-52c914ea323d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904109, "uuid": "02e06236-43de-4b93-92a0-6e57f9fd6d3c", "value": "49152:lVEkRHDjUOAvaPKnW5HgAhPsujHI5rUhX+EPg6fClA8YUr:lf1MWDskI5ApPEAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904109, "uuid": "e16f17a9-4075-4298-ab22-39a3ca0e71b2", "value": 3342200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904109, "uuid": "a18d654e-b277-461b-8952-9dcdd4b0e5a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904109, "uuid": "84fa9066-b264-4952-b2a1-9878a41ccd2d", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f0f3de-7f11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783984805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783984805, "uuid": "e200d319-2ef1-4f27-bdac-561aff3c7f4d", "comment": "Malware payload (njrat)", "value": "220c8ef9ac545f54ae0998d260221f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783984805, "uuid": "ac6064a5-447d-4863-8ab8-5c181f79135d", "comment": "Malware payload (njrat)", "value": "1e716a69b81f3272b10e3cc7b919e1a1f03005115fbf18ac8b1958a111a8f185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783984805, "uuid": "bcc0d9a2-b316-4bdc-b658-f8356e3ded6d", "comment": "Malware payload (njrat)", "value": "465b707813253d90bfe72eb8a24797335c5bcec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783984805, "uuid": "31c806a8-c4e1-4481-8cc9-bc45079290c0", "comment": "Malware payload (njrat)", "value": "bc6e2a81d178a529c58f38900895a423936246aac3a89066a303710afe2c6cb7c1a6c9157ba7b6805ce2784d5646405c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783984805, "uuid": "d420ad12-45c9-4f61-b744-84b3f36ef731", "value": "T1BB93D74977E52524E4BF56F79472F2004E34B44B1602E39E49F259EA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783984805, "uuid": "2388008d-c671-471c-8b12-dd3e1d96a52d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783984805, "uuid": "35961d29-1610-450a-ac85-c92993de895f", "value": "1536:rUwC+xhUa9urgOBPRNvM4jEwzGi1dD3DVgS:rUmUa9urgObdGi1d3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783984805, "uuid": "e0bbbae9-ba98-49b0-94f6-f9cb5d800496", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783984805, "uuid": "8f82555b-e3d1-4ef6-b714-e509ef9542c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783984805, "uuid": "e954f5de-8ae9-4ce0-84bc-5f0f030e9d57", "value": "220c8ef9ac545f54ae0998d260221f45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f523679d-7e55-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783904307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904307, "uuid": "90e9b6a9-c0f8-4474-b09e-68d5fe7d7950", "comment": "Malware payload", "value": "9f12bd92b5cca81e0645f4ec2db8857f", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904307, "uuid": "ec852dbc-abe4-4e77-8fb5-51c5afbf05f7", "comment": "Malware payload", "value": "2012fa14729a5c0977e824b2937707002ee992865c6e171a023a5965090f71bd", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904307, "uuid": "b7384ca3-12fc-4c0d-aa52-395626c489c1", "comment": "Malware payload", "value": "951e9a9ae06fc1cc6d3ab076785f69aaa235e13f", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904307, "uuid": "cd83d19c-6da1-4c51-a030-f63b076bbea6", "comment": "Malware payload", "value": "9723853fc1560e9465c046e661d9ca4530d8b98c50a5bafc1bed9d1df8cad3183eca9c91ecc0893d2928756e2fea2504", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904307, "uuid": "d77561ee-c9b3-410c-8488-622b69ab70a0", "value": "T1971733579B76D6D2D5AA167401E8C1B0C21FB2BD3ED4B2F00345C728EC289B95DBAB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904307, "uuid": "310d18b9-8050-46cc-953a-f7ffcc27a913", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904307, "uuid": "f74260a9-83c6-49b9-a37d-2d7c9ea1a754", "value": "393216:PSQYuOEonTcAJnz/vmSh3u4Q3uTWHqsEngi1S/zakw+ikXjftu:6LEonTcAJp+LuyFCgigakw+ikXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904307, "uuid": "85fc046d-8697-4735-8198-cd54da0ebe82", "value": 19025920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904307, "uuid": "6d9c285d-aaba-431b-93e5-ecc795b9fe9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904307, "uuid": "37aef38e-4e4d-418c-aa4b-b7cc43f8ef09", "value": "Installer_v1509_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095f8fa8-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963182, "uuid": "6b8a9002-b3db-4d41-847a-a13e97cfeeb1", "comment": "Malware payload", "value": "f10bdd8d7a7f9fd49208dff7720fd341", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963182, "uuid": "d8645af4-c83f-4cb5-ad12-b205a46947dd", "comment": "Malware payload", "value": "2030ec7c10e0bd04736eb80b021f13a5af0b210ef004f0f6e2e556697b1c85d3", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963182, "uuid": "9de73340-d56f-4e8a-ad9c-ad19dbf98148", "comment": "Malware payload", "value": "26dfc9f737fbda490438631be8a923d752647ae0", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963182, "uuid": "8303e272-a675-45f3-92b8-c31967b76d51", "comment": "Malware payload", "value": "0f7224416acf2234f4235e60056e3f9fedad3eef306b8f45ff309c25aebc0ac9c1096398417d88b32cf737fd7b9df68e", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963182, "uuid": "787da993-f125-489c-aa45-ce0514205476", "value": "T14EF42308F5CBCE2BC647793AC4E5C1DE102CFC929E4A925B71627B0A2279F15D7C7A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963182, "uuid": "11272bf4-ff79-4fd4-8bfa-c3d8616b09fd", "value": "12288:8+327eNCpDyYufWSGBaO0N5zVdGAaET9xwH0HKfrXxj7N8SQOeKPNVtd2Dqp8:8NKcZyYKbcp0NjdGAjPTExjhbQOem3V8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963182, "uuid": "6590ce48-51fd-42d4-96f7-1964c641e6e0", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963182, "uuid": "847a4ef6-b77d-424e-86de-f6c00af50bd4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963182, "uuid": "a3df56c0-6dcb-4480-bfb5-6cb86d46cd72", "value": "\u63a1\u8cfc\u55aePO20260629002 \u6b23\u9d3b.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bea11e4-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963186, "uuid": "1860eb87-7583-44e0-b64a-7e4e44385682", "comment": "Malware payload", "value": "f3a88d3e132c397897c6b956352f1d4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963186, "uuid": "26849c03-10a3-4a82-b297-000bdd1e8675", "comment": "Malware payload", "value": "2043f6fffed1784735fd4f1cf017923c7ff4c6f44dde4e1c01c0baffd89800c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963186, "uuid": "3057c89e-1d23-482d-a934-e913555ac905", "comment": "Malware payload", "value": "38788d2b32cb91252aa572cbc2a370c5d083dd8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963186, "uuid": "196e136b-efc3-42d1-9cfc-fe9c220a51b3", "comment": "Malware payload", "value": "f45c9689c3e2b47e6d0df1c2086fb9657b9b64ff4988f4402e7712ffaef3c7b5c25b6d3c7dea34971dfef9584f505810", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963186, "uuid": "4f0c0b3b-d186-4ea0-88a5-46c664ba84ab", "value": "T1A5648D13BB878F96E221B5754AF3C27CA9E93A0606F7C466C3796B17079D1C0B819EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963186, "uuid": "28eab776-0b5c-48e9-bb96-8a1801efad09", "value": "6144:r+eiKyBoLhKN9JI0Y8AEBQ6QCILG4MU6+WRtgk+VwW3i:r+eiKtMNI0YtEBkGhr+Wok+Vw4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963186, "uuid": "4288611a-0411-4ed1-bba4-9a6e0a1d24f8", "value": 325520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963186, "uuid": "9daac31c-85b2-4580-acdb-a8473bded78b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963186, "uuid": "5c27e6e2-94bb-41b4-aef2-8c783e116c17", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c7cc55-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783906214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906214, "uuid": "4c66f484-1c42-4fe2-92f0-edf5d127e20f", "comment": "Malware payload", "value": "3288a2005021d95c93fd55053b7cc31e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906214, "uuid": "3e2d1b7e-ff0f-4e1b-8e5f-707715d3d274", "comment": "Malware payload", "value": "23b2d08a1e983d5419f26263494c3f356f344ac5c52fb967c1e6c6f1bbfd64c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906214, "uuid": "f3da1180-19ac-4015-9ffa-ca7c013f1763", "comment": "Malware payload", "value": "faee72866ab1c09973bb3198c6993851e4bee0e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906214, "uuid": "e5dbb0e6-c00d-4cc7-bba7-6817db4e3bce", "comment": "Malware payload", "value": "d7422e1856c8ecb359e5ab65e64f626fe40de6c92323247fddb591a69017ff8baef7d7fb2736b6dc2f8e91d68403c17d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906214, "uuid": "0f3d3538-0093-4782-993e-ac44409e3596", "value": "T15217BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906214, "uuid": "990f09b8-7c17-4d22-80fd-affff2eb8efe", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQU:cqYUQuVDt0TZEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906214, "uuid": "975559eb-a380-4bfa-b4cc-d5b2b15b0332", "value": 18907136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906214, "uuid": "542635c3-f55f-4d9c-8d01-000e54c4bf47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906214, "uuid": "cfa3df13-7e0a-45ac-8bfc-c625cc4c94c2", "value": "23b2d08a1e983d5419f26263494c3f356f344ac5c52fb967c1e6c6f1bbfd64c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a0bc0f-7e57-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783904945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904945, "uuid": "86f78b88-689a-4de7-a3a5-fc869420bff4", "comment": "Malware payload (ACRStealer)", "value": "378bd64d4c90abb345c0ec3bf4cc4962", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904945, "uuid": "682a6b1f-beb5-41c1-b1fd-7e1a1245501e", "comment": "Malware payload (ACRStealer)", "value": "24636cfe302fe7c74efa9e78f343e1fdd984468117ebf2df80a141ef7a635fb8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904945, "uuid": "e5b7b0a1-4662-4c6f-8f12-fd1ad9b5c779", "comment": "Malware payload (ACRStealer)", "value": "373f5f2af400943e959f7aeb16dca2b0cf90cb8e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904945, "uuid": "6e69c6f1-1a43-4aae-9c7b-990744815f39", "comment": "Malware payload (ACRStealer)", "value": "2ba571fd7d36c8e7dfc16cf5749d857abc1093b799361bb38fa836ee178c56d237b5c12d077c61bc23dc4135ec766eab", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904945, "uuid": "d66a3c58-2bd7-46be-b990-63d5ddf08c67", "value": "T1361723BCB4B5B96AF5D4433BC6C12CB2DB2CA540D7D93D9B8E2041527EC320E5F6A861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904945, "uuid": "f45add8d-eefc-4803-8bee-c3359f11175e", "value": "393216:VvoJYzm4PaJBjPvwL4835pf/9vV00s7UMMeEH5tWehhfkiI7UXFD1iOL:VvoJE5EtgL445ptvV0LBMhEgh9I7mmOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904945, "uuid": "65d71e6d-d880-4132-8322-a7c1c645b577", "value": 20227273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904945, "uuid": "e326946a-ddf0-46a8-85c7-5d6cf3aac34a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904945, "uuid": "5a7062ac-17b3-471f-8909-c7d00a6cc162", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8455390f-7ea0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783936330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936330, "uuid": "b443e993-749b-4b7b-99b0-5698e210be24", "comment": "Malware payload (Efimer)", "value": "0c193f0e39efbab65b8ab5dbd6bdb7e2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936330, "uuid": "abcb4458-b4ee-4b21-b28a-a352f0e695d9", "comment": "Malware payload (Efimer)", "value": "25f0b776a5fa4bbf0f0727207cdcf58b3f883d2f0e210556350d050b427e69d4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936330, "uuid": "7902b992-54a1-443f-9263-80804bbd8763", "comment": "Malware payload (Efimer)", "value": "cff5e73dac39d69216ae96b95134373ff5ffc418", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936330, "uuid": "f817c5d2-a3c0-4ad6-80a1-8c118a99fe8d", "comment": "Malware payload (Efimer)", "value": "40f4dc1554875b24bf7205fdc976b24f731b9ce20399083bf9e4d92fc7101ecf8785cf55ea21b7d723021d6a89731e99", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936330, "uuid": "f85b944b-ac03-48e5-a6a5-b59af00f8bf5", "value": "T12BE6335859C022EEE6D3527CAEE1855EE5B9B8B64B31CD8B4778C3B57C471E08878383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936330, "uuid": "1eac984a-5f00-4e12-8a63-8c379cde3b5f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936330, "uuid": "e48f4d07-77b7-4c8d-98c6-ae4a0d3e1d4c", "value": "393216:IwbMVk9f8Qf/A6DXMCHWUjXhcuI3/PGTAI:IFo9XMb8X2H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783936330, "uuid": "e51fee9c-90b7-408c-bb6d-3bdf9a4ea944", "value": 14295853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783936330, "uuid": "ff0c9630-00e6-4737-9642-a9f03eefc483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936330, "uuid": "02358aba-ce27-43e6-bb47-1f0dd86fe301", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627777d7-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783906208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906208, "uuid": "cf22eba7-5cde-475a-bedd-761e0f9e3dfe", "comment": "Malware payload (ValleyRAT)", "value": "fd83c55a4de17d34dfc4e6b49e892256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906208, "uuid": "3e91dd03-2c93-4460-bf40-58b2a5d7fdff", "comment": "Malware payload (ValleyRAT)", "value": "272747b26622bc9b084b36935efeeae8a63a388db00f94c6359b02368fd52d0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906208, "uuid": "e52dcb85-d480-40de-adb5-66b7063f4d48", "comment": "Malware payload (ValleyRAT)", "value": "20ef87fe5fc5b2ba3ac43452d33db1ad127bd6b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906208, "uuid": "73f47216-d355-4019-912c-f01daf4b3afb", "comment": "Malware payload (ValleyRAT)", "value": "6cbe21317a3bfa86c058456089ab491f6e6fb499646c3f7fe97311ede9f7f43b9ed64c310dd0e1598161a20d6211974a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906208, "uuid": "c5cde43e-ac7a-4b3c-b930-93f71d258ffc", "value": "T1AC847C14FBE504F9E1778538CA728507EB727C9D07A0AADF23A489561F23AD09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906208, "uuid": "f54cba2a-d6d2-4462-b330-1093f20d643a", "value": "1450c9beddf63875e8aaa9b4691fb1e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906208, "uuid": "275f9849-ae23-478c-87f9-53c6bfa59a30", "value": "6144:ThwQwPpZ+UPwGihxJ6GcTHhjvP5lJ/yVu51vAVW6gj+c8:eQSpQUSs/Hhr5l9qM1voDgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906208, "uuid": "301fa4b8-24a1-4064-9f33-f1931c2dbf4f", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906208, "uuid": "221de97d-dfec-4450-a234-cd7ed1a9ab08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906208, "uuid": "7a93ba1c-242a-4700-8b8c-09be4d5ff946", "value": "FD83C55A4DE17D34DFC4E6B49E892256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393bd52d-7e81-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783922890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922890, "uuid": "c06b9724-7b6a-4239-bf8e-7aa7bd4abfa8", "comment": "Malware payload", "value": "7aa272f41f4c4a17637ed031f96fb639", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922890, "uuid": "573b56f8-3e60-44cb-888b-05bfa3a1e050", "comment": "Malware payload", "value": "27b544993d20e4f2c09b0ee11acff04ea190f0b9eb6ef332a5fea4d91bf2debd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922890, "uuid": "0f8191c7-f894-4e6f-9102-9fa27ddb12c5", "comment": "Malware payload", "value": "1abbf7320bb1a9c05c0d18123d5c9635baafb16f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922890, "uuid": "074ea009-55d2-4867-a33e-727b125cadb7", "comment": "Malware payload", "value": "89b193f429808dd679e145f23e5bace8c62875950444d6c8fed3eaca081dbc8ed54d161a91e7d9fe4a62a49b8012cd88", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922890, "uuid": "52f7db1d-f0e0-4d54-b644-0d12590543a0", "value": "T166C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922890, "uuid": "2be3465f-0f6d-46ee-8ccf-9c9cb44ac4b1", "value": "768:o8vCB+25j6es8Re9FYpMSUpi+20qUpi+20YQX:o8l25J4d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783922890, "uuid": "588c2f00-5724-4e17-bb98-0ba00419e2e9", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783922890, "uuid": "33d67c30-5b87-4859-8d06-6ee75e09e129", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922890, "uuid": "c75f42db-5da4-4b43-a48d-97840ecf2f1d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6738fc0d-7e54-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783903639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903639, "uuid": "6740ecdf-b3ea-4b12-a4be-e4b5f59f2ca8", "comment": "Malware payload", "value": "a917421bb484903458f76f27bb513140", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903639, "uuid": "0b4e3365-44f8-4ca8-936b-49044d0c086a", "comment": "Malware payload", "value": "2879a63cd7c75388935229a859eb0ba955f0af327520c2e2f8f561341c6461ed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903639, "uuid": "b9aa5675-e1d5-45b2-8620-9218a09a85d0", "comment": "Malware payload", "value": "75a7531ea5919f8eeacf7ad2f3238f2189be8ba6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903639, "uuid": "bddde071-12b4-4e0c-908a-4ff43780c863", "comment": "Malware payload", "value": "384f91dfe00fd3ea395fa50f6659c8c2081130504e1cf39fea832d143cc552a1000996fddb1b352198dec5e7a19004c6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903639, "uuid": "3f2c0256-58d5-4ce3-a64f-3021dfdb611b", "value": "T1BB215BDE46608ACC4982864979708588DA9E4BC1EC43CF4D6CD905BB31BCA74776FF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903639, "uuid": "56978399-738a-4495-832a-376395f45cfc", "value": "24:H2qlUb8LwIqausW40Ln8pgRl89AJ+22MSKvgzro97C6:WqSDausW40Ln8pgRl89AJ+2zSnkpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783903639, "uuid": "a63ec4be-b393-498b-9e77-4267d184ae2c", "value": 1126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783903639, "uuid": "da04c77a-2283-454c-9936-70ab499daa42", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903639, "uuid": "9a288ff4-fcd2-4e5b-9482-965c6fe3e051", "value": "busywget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8642e4fb-7ee3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783965110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965110, "uuid": "e3d1ee17-23e0-4da8-b0ae-4a4911c2c710", "comment": "Malware payload (Mirai)", "value": "2de0defebe44afa7bf53dd9b53d44f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965110, "uuid": "61dc6d0c-8b48-442b-a190-69d2c59df010", "comment": "Malware payload (Mirai)", "value": "28cf909b7a9e41e8827851995aa6ccb1f56fe54c126c69eb8a5f9bb211ab9ba5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965110, "uuid": "05af9658-84f1-4d3d-a759-cf1c229aab17", "comment": "Malware payload (Mirai)", "value": "4e734e5e5d695ce2e5ee7ed5c0d8844ebd9cc750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965110, "uuid": "9eaf6adf-110f-4355-b7ed-f4ad15437563", "comment": "Malware payload (Mirai)", "value": "1433302951e49071ecffa4d0b6a244c0716d43493287f7afa6bb72594a741789fe2f3c46d1c6c7aea3936aae385cd074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965110, "uuid": "5e3db324-55f0-4ce3-8237-c111cde17eb2", "value": "T152C31889B8929A22C6D316BFFA4F42CD773663E4E3DF7107DD195B21328742A0D6B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965110, "uuid": "e8d50add-1ff0-4c99-8a17-fb9c103585f9", "value": "3072:jnREVsW6L1KD5GAciU5IFaOcyZHE7YPASVtBnbV:jnRE9EhAcioIhnZHgYPASfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965110, "uuid": "06e35f84-95a6-48be-9471-55e4df480fe1", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965110, "uuid": "6cc991c5-802e-4f37-af52-46a8bac43b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965110, "uuid": "d099eac7-3c6b-470d-93be-4bc308a5d7f8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530e025e-7edc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783962017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962017, "uuid": "f3ccd0f8-e64e-4661-8ca5-4dc609d11a73", "comment": "Malware payload (XWorm)", "value": "d2c37c4b63bc68c48a193af4ea73d871", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962017, "uuid": "418aa124-7778-4720-88eb-261d824ab5a2", "comment": "Malware payload (XWorm)", "value": "28e36507780c6c178b4d474991752800e9d990f64ce64a3cea01b28a48911970", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962017, "uuid": "59363bf5-f793-4a20-8e79-ba25891ade73", "comment": "Malware payload (XWorm)", "value": "1139432fd3e058c51589098a0c321fd0a9fd0aed", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962017, "uuid": "68dfc2f8-4f65-4e6a-bdbd-ab4fd6283b8b", "comment": "Malware payload (XWorm)", "value": "70ff3f58dc15b2dd98bc832f370cf27b535226658493437975df1774cdd414b2128df9fa554b492a37a260a63e030225", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962017, "uuid": "3c337ae6-b810-4513-ab07-ca54af833bca", "value": "T1BA05339AE7B9407508FAA1BF743693FF8E12CD81E2680FF17211991057C63F591A293B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962017, "uuid": "cec89419-5d04-43cb-9cb8-5813c640b1f9", "value": "24576:EQEkEX4w6DG5D7/qRoNLBaKntSItgi5KV:Vm3D9ZxSIVKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783962017, "uuid": "e9e234a3-0479-4f9b-b8bf-d123b2491873", "value": 821054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783962017, "uuid": "539b4858-a9d3-4d3d-b46f-96f2a38c570e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962017, "uuid": "c05f1cac-0741-428b-9aba-e770b5d45124", "value": "npayment_0026_7514376.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52162e6a-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963304, "uuid": "6ee8a796-61a2-4e53-9a7d-eb0c1380d10a", "comment": "Malware payload", "value": "9cef91cc56cd508c9865e99d29d6b343", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963304, "uuid": "ecdbf8eb-fb9e-4ff6-8f8e-39af25f3af64", "comment": "Malware payload", "value": "2ae818cef16fd9667be97db3872781f0e9cdfa70a2569e930577017f13337893", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963304, "uuid": "7f104510-cd27-428f-953d-165e21943bfb", "comment": "Malware payload", "value": "7b9084e3fa4eac049a223b6120967f1fd09cdfcf", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963304, "uuid": "1ca6a63c-623c-46b7-bafe-9b361989eda0", "comment": "Malware payload", "value": "b40f448b99bda6673e160054b74ef6a8dcb062d23fa7ad5a9741032f887a137c28deec597885001d858b66d493f62663", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963304, "uuid": "715eb8cc-6b2b-4e28-9302-2973bd66ba66", "value": "T177252316FFF4D61BE313967484ABC523444DEC913768A6873234B30AA537AF069C736A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963304, "uuid": "12d09f5d-b71a-4a5d-9a9e-452d7dd4bf33", "value": "24576:yfwI/uP1PbwntCT0rcEW24VJ+VYdULmeajGJut7P/:yfwIYSntJVG+GdULmZMuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963304, "uuid": "49f83c81-73f9-45da-9f6b-d880fa4157d1", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963304, "uuid": "fc90b5f0-db1b-4a49-a2d0-1d3845b81b25", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963304, "uuid": "8e3c61f9-007d-425f-9fc4-e87d3c87d528", "value": "Detalle_del_documento.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0cc03d-7ea2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783937308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937308, "uuid": "223cc5c8-966f-40af-86c1-1ac94cdcab4d", "comment": "Malware payload", "value": "0cb34b950bb3f9fe7f0c01807cf7de14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937308, "uuid": "690d8933-ba6f-48de-8cb0-31fe0c746837", "comment": "Malware payload", "value": "2b1bd9e597fe0bc6f3e387114712cd673fdca2746e356d148abd8b58f0cc16ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937308, "uuid": "d0764708-c4e5-416d-ad2d-a50177160d07", "comment": "Malware payload", "value": "3186d9c005a07b9ccb1b2594ef2615587c613347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937308, "uuid": "84c42b16-2a86-4095-a934-6a82c6ceeb4d", "comment": "Malware payload", "value": "3dceacb7021c0273626a8654b8b1e731a45df547b9590c7ec9c53d11622273788f8793f6be1b224106eecbfb9503554c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937308, "uuid": "432578d9-ec02-4af6-ae25-ad2eda1035b9", "value": "T1E7768D09B7D406E4D173DB74CA66C332E6767C926336830F15E6F64A1F736A08F6A620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937308, "uuid": "70729f85-89ab-46fd-835e-23ba27afadce", "value": "9615b2ba336fcc1a132bae4130b3fa44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937308, "uuid": "1a41ae9e-7d3a-4aae-ad1a-d1cc89852b1e", "value": "49152:2MIFZXPzrnlUNytr0dmBKf578TO+6lPz70kkxxjhQLZp7d/aX7Hqj8uKt10wqrhk:GUGri78SVrcxqp7FPg+i5+eaOq+eO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783937308, "uuid": "5e6f9016-9fbe-4dbd-bb68-3ae8714c6a0f", "value": 7430656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783937308, "uuid": "a99f0682-d5a7-4ebd-8e7f-3e47c7f31442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937308, "uuid": "205d97b7-887c-4d84-bf8b-c67548749f52", "value": "0cb34b950bb3f9fe7f0c01807cf7de14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0f419c-7e87-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783925530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783925530, "uuid": "3dfb6bfb-c688-4d01-8aa4-0ccd311c44b5", "comment": "Malware payload (Efimer)", "value": "ea483fe1f8b992bc63e1303a945fc401", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783925530, "uuid": "dbe931c7-5201-4543-be2e-870f5b898a36", "comment": "Malware payload (Efimer)", "value": "2b2e0434fb316a61a6a817302c2bb0d0d6957127cc4470c51ea67eff0347e279", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783925530, "uuid": "c0c36ee6-b616-4455-99ef-1a171ce4d8c4", "comment": "Malware payload (Efimer)", "value": "58cd856d11c00b4c169a2a5c3bc97a8a47bcf36c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783925530, "uuid": "cec5eb73-3f24-4b54-a442-539beb2eeab7", "comment": "Malware payload (Efimer)", "value": "fec24f01c1da1a6ff4bd3aa4a77d3d98befe9cdeea56d56b7e7cc554a86f87e8fd66af2c11f6f4d69fecf04c3cd89286", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783925530, "uuid": "f4df97cb-4f4c-4477-b3da-e56afdf81bc0", "value": "T148E63358A2D051EFDB63013CEEE191B4E8A974751B33CA5B87B89260EE136F54C3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783925530, "uuid": "f0cbfea7-d4e3-48e5-8de2-57be438b591e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783925530, "uuid": "b2a91b4f-d1ce-44e8-a0b1-50a593184a16", "value": "393216:PACUroGJ9+OMEvinUeXMCHWUjXDcuI3/PGTAI:PlU52OYlXMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783925530, "uuid": "9fbb0069-7019-480b-97a4-4096e993ed66", "value": 14249431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783925530, "uuid": "22107fff-dea6-4398-9b54-0d07509d4fac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783925530, "uuid": "4dcac145-aece-4365-9de5-9f2034fa97aa", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65ace27-7ef3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783972062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972062, "uuid": "9888ca7e-8104-4ce9-a6d0-fcbb83435912", "comment": "Malware payload (AgentTesla)", "value": "fd960fcde32eb18f1b2e0a3adcf999f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972062, "uuid": "3f9436de-fe4d-4dc2-8984-dc921eaf5cbb", "comment": "Malware payload (AgentTesla)", "value": "2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972062, "uuid": "9536b48a-8507-42ba-a8a4-6afbd319101e", "comment": "Malware payload (AgentTesla)", "value": "9b3bcee35529ab8dbff186c748c29df2f0455de8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972062, "uuid": "17f573dd-1dcc-4d48-8f00-8a5727820555", "comment": "Malware payload (AgentTesla)", "value": "6d1839443e8cf509e015cd900b09031edd2487a58b54be5fd2d25fb529c0137755db23545eefd8633c54fc21919c8f80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972062, "uuid": "28cb4a7d-db4f-4457-bfca-5b17087a9599", "value": "T14EE5295295E862233320FBED962DDE38940EE4432D198F54798EEB387D2CF89E214757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972062, "uuid": "fe35c677-8175-4deb-8ba0-f8cebe68c2cf", "value": "98304:sQmBnsiupkZ3h/1/P174AMoQLb302UgFAdF8e2n+Ft33x5yU3vF0yunBE644uNJH:GBns3pkZh/1/P174AMoQLb302UgFAdFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783972062, "uuid": "f4b1c7be-3905-4f18-8015-88a338866ff5", "value": 3293663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783972062, "uuid": "4b0c13fe-a4ee-4f0f-b31c-23f7b5a3d80d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972062, "uuid": "c163059b-3c81-4635-aeaf-df6b1e13b273", "value": "MT103.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09354d4-7eae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783942498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942498, "uuid": "ce1775c9-78d6-4b6d-9507-2f9539090006", "comment": "Malware payload (Mirai)", "value": "87411403024867b952c44aed5eba6932", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942498, "uuid": "1bea38e3-ec71-495e-9749-01a0d9c1c162", "comment": "Malware payload (Mirai)", "value": "2c87518cbc2b1c8733916a1b0af5a6061f90c921fd733de9ececf243b24e0c86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942498, "uuid": "6d1c8a20-9a6f-4d49-aea3-24fb161b9356", "comment": "Malware payload (Mirai)", "value": "0b79191852b4cf4b27bab7c2543848c6a2f7ffff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942498, "uuid": "ddd87e5f-5b4a-455d-8d3d-c0f3f731990d", "comment": "Malware payload (Mirai)", "value": "f7b3933230e5ff2ed34c9eeb0efe6c3a3c0c7492c1d0c515dba54978f746e61c5b522df12b7caa1ca2f84f9141c033ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942498, "uuid": "a22634ef-b651-4942-a0c8-15ba72ff88b6", "value": "T1A3F3D617EF601EF7D8ABCC3391B9870924DC655A22A82BB57934E438B64B54F49D38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942498, "uuid": "6172ecbb-510e-4a81-9fde-072677fb9231", "value": "3072:m7z5pkZUHTIDA5FIgyZxJ06faJHDq3Anbu:mHIUHTQAMgyR06fa3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783942498, "uuid": "7c04bbe4-d1b7-4c42-a422-22b7dfe60957", "value": 158316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783942498, "uuid": "b5be8253-ef4d-4423-8e1d-631540079bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942498, "uuid": "b7baef8d-be0b-4812-a76c-c475017a2561", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e00c39-7e57-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783904959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904959, "uuid": "480798f9-ed44-4e8c-a4c8-23117582fab5", "comment": "Malware payload (AsyncRAT)", "value": "72b66bac20017e024ccdef1c786c04ba", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904959, "uuid": "9fe3c333-0e1d-4257-a77f-c75f5dba90aa", "comment": "Malware payload (AsyncRAT)", "value": "2d5b38af2b9b6b5b2a6fb2416322d4143cfabe6c958eac7ca34ba41be0f4831e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904959, "uuid": "b78bbb69-c8de-44cb-bbf9-3de5229afe09", "comment": "Malware payload (AsyncRAT)", "value": "a3498ddeca65ce8bd339c08b19cfe0f0200e68f7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904959, "uuid": "df1b34d6-594b-4e0b-9b8f-f61783dd7856", "comment": "Malware payload (AsyncRAT)", "value": "cb6c3bf8659169c022833ecb60536cd9b3daf68b0d60bce39fbff8fb3d87b44d40e5c71f888f05c12ebdd43bdefb5eaa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904959, "uuid": "ce078762-178a-481a-87cf-b50f1dc31606", "value": "T1FFC23D0873E8C572D2FE0ABE883395009775D55B9913D75A6FC890AE2E23BCD8A14BD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904959, "uuid": "8f0272ac-54ee-4fbc-af30-873a5c8efb78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904959, "uuid": "4d1e0d89-8b6f-440c-96f1-95eda0c5c08c", "value": "384:jgSVEEMiNPWmeOsVa/KFHbh0yH9qbuUscCbQxnCJfJBndnjJvKsbT+:jgSVXFg1VDHF0wIb1BBiBnesbT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904959, "uuid": "fe5b1abf-e641-483b-bd4a-72688ce55e73", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904959, "uuid": "195b2b04-ce13-42d2-aa38-0f20ab79fdef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904959, "uuid": "13b4c1b8-fef1-4744-a11b-cd8b2886acb8", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3665a9-7e7d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783921229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783921229, "uuid": "cd8ceaeb-7c28-4842-897f-ad921b14b3f3", "comment": "Malware payload", "value": "e0a38510d1e2324ecbee3433419c5d1f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783921229, "uuid": "aa5e15d0-e74f-403c-93af-18d3f85eb21d", "comment": "Malware payload", "value": "2ecaf194a03c247d06ece3e041ff1ca6119db5686ce89e68a7c16729286bc2c4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783921229, "uuid": "4570d6ba-ad54-4572-9ffc-c8fc2ce41acb", "comment": "Malware payload", "value": "15cae7051ed7e59284ec7e44f25309639df41eb3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783921229, "uuid": "eb0dcf36-687a-4c26-ac5b-2944e6919dad", "comment": "Malware payload", "value": "6d89ebef3c1d195225e2a1367b7f6bb22513cafa0dee007605d6476215fcdb88ea1f1f382405fa820333dddffc9dfbcb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783921229, "uuid": "4bd6c3c1-8eb9-426e-8382-17a35fbf2e39", "value": "T1D1236C6516857C14AE99C4365C7E2F0CBDAD43E6314492EE7FCE3CF28C4A6ADA20861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783921229, "uuid": "13b78ced-5d6d-4094-9a6a-b32c3401f69c", "value": "768:Vr9NyXsZztC7m9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9HusZCcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783921229, "uuid": "0e951ab9-2971-4b9c-bf39-e93d3a3e49dd", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783921229, "uuid": "55b29c62-f87d-4bec-95bc-ac9711afcaa4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783921229, "uuid": "479637a6-0886-48d7-b234-86175e1f01ea", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bae1fb-7e98-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783932891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783932891, "uuid": "4579d5a7-40a8-4e64-9bb8-fcd9596cc303", "comment": "Malware payload", "value": "05caa54de250222232424c77551488ca", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783932891, "uuid": "792ef52e-c409-4cb1-a6a3-163dacf26dd7", "comment": "Malware payload", "value": "30e56fa70fb5db453cb60d95a3846fe1b0414e8c20bf236e2f2f5d52c1e5c187", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783932891, "uuid": "9573cbae-ca12-4b8b-a860-b405438cfc1c", "comment": "Malware payload", "value": "1cc26dfb9d0d3599d5df335668df5bd1dced107b", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783932891, "uuid": "b2550ba7-aeb7-42f4-9f31-35f4f74328be", "comment": "Malware payload", "value": "06bfa98e181f58a9c39cce4b21ee60fae5814732e48c8265303a32641c3d08a0482006d3414d5e0d9cc62d936b078c30", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783932891, "uuid": "6698178b-a178-4ade-b219-8a6070f51266", "value": "T1D8A25BE89A2429D2CE6A7430C1E8EB436C38F2A31722A1D716B9EC240D777C5D73579D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783932891, "uuid": "f91c15a6-6123-4519-a0a0-2879b61469b8", "value": "488c91d3d0299633c437d2e5ec7d1042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783932891, "uuid": "4d050154-ebe5-426b-82d9-4fcb999145cf", "value": "384:yuE8xv6/KjfwC5ldryFpd8vzGh8ph31q9I+R9z1ez:yulxSCwpduGh8L3Fi9zoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783932891, "uuid": "dd61cc3a-717c-40db-adbd-b6dc88b2e8ac", "value": 21560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783932891, "uuid": "634f0566-395a-4769-8a4e-8e6565a26096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783932891, "uuid": "c9871f2a-b480-402b-823d-b838b3eecd98", "value": "m19fij4wr.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502019eb-7e4e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783901024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901024, "uuid": "d2affd2d-652d-4d18-a0dc-60ed4c1cf88a", "comment": "Malware payload", "value": "5ee7c0f871d1cf686ee225e3e5ce9c5d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901024, "uuid": "03139de4-5fe4-40b6-9b1e-f49a7b1e8338", "comment": "Malware payload", "value": "319f9b804960033b7ddbf8a4a6cde9ef6eef8d2d46e892c1a210f1ef6ef023f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901024, "uuid": "67df50c4-b0eb-4da3-b6dd-217089041350", "comment": "Malware payload", "value": "5aa222e4510740f778c6a210cc3af393c36a8568", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901024, "uuid": "949e6b07-e322-42d9-ac0f-a25915c2f4e2", "comment": "Malware payload", "value": "ebb359b51a5328ebd1728af072bab9c71aaa7422f94fb4f0cfaf15d52f56c73ee7cfce51f7cfd965477f9529c92b5db6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901024, "uuid": "0a3ef5a0-9cfd-43b5-b75b-01f942bb83a0", "value": "T10F01ABDA4940AD4080299A5DA2E7A1D0B451C3CE094A0F787F9C5E2CFB8C910B03AF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901024, "uuid": "4de23e6a-75b3-4c49-b79d-1ea6ac4bd186", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkai8CFles9CDVTCTviFSCeO/l0FCs30auD:kXCKysE2hi0ziQvZoha36Hw5c5287307", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783901024, "uuid": "e78a1191-b3d9-4725-97e3-6ce34ee4e7eb", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783901024, "uuid": "8cfd43d3-3121-49f4-a4ad-47c6c3b5b368", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901024, "uuid": "79b2d6ba-6daf-477d-a17f-365c85ce0a3e", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1518875b-7ebd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783948599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948599, "uuid": "446ec947-56d2-4c97-a8bc-c54d4b152690", "comment": "Malware payload (ValleyRAT)", "value": "dd0634be42cda34fa24999471f418ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948599, "uuid": "eccdf3c7-728c-49ac-979f-9a58552ee025", "comment": "Malware payload (ValleyRAT)", "value": "32146526cbc3e98467c0e6fbb684f489015e59bed6a4dcff756f6f82d787c5ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948599, "uuid": "424cf9b0-79ed-4149-a3db-c520ec4e48f6", "comment": "Malware payload (ValleyRAT)", "value": "842612a287011c76730a167a6cae7786aee760e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948599, "uuid": "8130dbf0-886f-4755-bb14-15871d2e765d", "comment": "Malware payload (ValleyRAT)", "value": "04d8bbc439c664797dcdb342a0270bc9e5a1540992b4caa67621d57545f578df3b196d0d7bbcf267b4b9bdd009a44434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sx", "colour": "#3EA36D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948599, "uuid": "deb12758-4eb4-48f7-94fe-6ca4362b6263", "value": "T135278E4BB2A101D4C5B6C0399BA78167F7B1744A0770A7DF21A497A92F37AF01E7B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948599, "uuid": "1d32c17a-648b-427d-aefb-3981315633be", "value": "7ed4944b661ec154c19c430f88aacd75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948599, "uuid": "a13d6492-fe8c-4a2e-829d-617ce7c85931", "value": "393216:jHso9GzEcsBrLi+AGQYSmvcJsv6tWKFdu9CFSH8qg6rul7:tyA5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783948599, "uuid": "4c77b8e4-1743-40ef-8837-224b78334e4e", "value": 21395784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783948599, "uuid": "4e5da450-d938-4193-b833-ddbb9947100f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948599, "uuid": "c939191f-dd17-4b07-a40c-ae982706cd52", "value": "2026.04.03\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53528774-7f00-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783977479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977479, "uuid": "b8285ac4-ca7e-44c2-8861-0b29de4ee3eb", "comment": "Malware payload (RemcosRAT)", "value": "4d9e7a5e24681bbcc2efa3e97c1e66e6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977479, "uuid": "bdf1ec78-842c-4786-a8a7-dd11dd4a77ef", "comment": "Malware payload (RemcosRAT)", "value": "34647bbf33ca3f21aa3dcd604e62dce27198bb6b451e9a00a1d72fe23400da1c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977479, "uuid": "9eb4115e-ff15-40ec-a560-b3ab4ba78737", "comment": "Malware payload (RemcosRAT)", "value": "5b977a9783682e41d67c84f3e524ca61749dfaa5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977479, "uuid": "8b0b8c77-a7fe-48f5-8820-6ba3c4cf1772", "comment": "Malware payload (RemcosRAT)", "value": "baea3d58e48b944e5bb32532e5a3716fff1eda30e59a920205cab2d5c460025a4538ef0555ad1c21bee0a38b4e6e1d37", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977479, "uuid": "bcd489f6-6d9b-4c1c-9efe-095abab04eba", "value": "T15F03C67D8954ACD2726336999C2AC1102C8CAA5BB4535C7439BF38C94B7634EBA3F1CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977479, "uuid": "d6e962ae-01bb-48a8-a15c-f0f9f061c675", "value": "384:kBmvQRjXzhzeWvCubmrMx0rsJdEACqC3Cf8L7B/3:imoVDVRirMx0r8dEJ1Sf8J/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783977479, "uuid": "f90c1fc6-42ba-4fad-a3ec-b935190ff50e", "value": 38620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783977479, "uuid": "c134dc4d-9aee-47d2-b4df-c1b94ee1781f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977479, "uuid": "885f3573-4f35-4f22-b389-331ad8f57eb1", "value": "privatethignsareverygoodformaitiasentriethinsgs.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0135c3-7ea0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (StomidaStealer)", "timestamp": 1783936532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936532, "uuid": "a45c3510-f0b3-4dcd-ae46-faebdd27e86c", "comment": "Malware payload (StomidaStealer)", "value": "50cf5b4eb0b43d08455a381b05f4a4d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StomidaStealer", "colour": "#BE2375", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936532, "uuid": "0b828300-e101-4daf-9e91-58d6bdc3cd83", "comment": "Malware payload (StomidaStealer)", "value": "34ad97945a1f70cdbf8af7777a6c71c990d841840cf3c94a387f6cc83450ad4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StomidaStealer", "colour": "#BE2375", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936532, "uuid": "569a21d2-4620-438a-8034-e105dbbd2a02", "comment": "Malware payload (StomidaStealer)", "value": "63000ff3aa0958801d3549446c7853f0d0223bcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StomidaStealer", "colour": "#BE2375", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936532, "uuid": "1fe962ec-2a7d-47d3-b559-105ebc961155", "comment": "Malware payload (StomidaStealer)", "value": "4aea086af402ebcf52c561ee33a411fc24102fccb3d454a96947774e469e8ce5a2b1b7aa70154372ab639f9360f71340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StomidaStealer", "colour": "#BE2375", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936532, "uuid": "a685ffb4-11f3-41ff-91a8-24d460ce6ce9", "value": "T125C63A47E8A145E8C0AEE535CA629213BE717C885B3423D72B50F7643F36BD0AEB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936532, "uuid": "abf4bb19-65dd-4e07-a1a5-a47b51d385e2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936532, "uuid": "da2986f4-cfc1-47e9-a01a-abcd93e3f512", "value": "98304:7r92T1ylvBQ8cCdFGp24tpXMwOHzO6iMwESD:7x2TAhy8cbQzMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783936532, "uuid": "6decdb00-0062-4441-92d1-6e460cdb6f05", "value": 11811840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783936532, "uuid": "97679d9a-155b-4265-acf1-7df37093a1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936532, "uuid": "a426eb8b-e551-4cc2-ab2c-4280c97bfa84", "value": "50cf5b4eb0b43d08455a381b05f4a4d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5095a8d3-7f01-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1783977904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977904, "uuid": "5d401f11-9462-46f3-b0ec-d61347071339", "comment": "Malware payload (ZigClipper)", "value": "36bcc9fcb9343ac2b013a91ee4faeba6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977904, "uuid": "c8833b82-451b-4326-8e94-d41da495d3ae", "comment": "Malware payload (ZigClipper)", "value": "352944118ad77aea5df1707fbbb541ae7b47421f05f148512d074a108097d0a8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977904, "uuid": "7a9d6f9c-60e4-4eef-ac8d-bafbe279a6b4", "comment": "Malware payload (ZigClipper)", "value": "5fb63984e5912c8350bca86f7b97fd1bbb1ed157", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977904, "uuid": "4695a9a0-4386-473d-8e18-0f8e2fd11c45", "comment": "Malware payload (ZigClipper)", "value": "8d215aabd0dbede974407af8aaa2eb1c81b137aa92043aa4fde37b0d1ef89f1b46e52a3b68ba33c4985ddb869f1b86c0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977904, "uuid": "c53f02aa-e285-4b2f-a8f6-7dd42709b415", "value": "T1B645AE1DE3CD12E8D227C234CBA29232E7B5B4560761BADB1799C6152FB39D02F7A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977904, "uuid": "0e19fe94-33c7-4871-bead-6d52938c4aa3", "value": "f765367f0a88e2dcf14edcaad7ab658b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977904, "uuid": "6159495e-9576-4746-b88f-e05bb940c070", "value": "24576:SS9jVBUaZP732a4Cd9rfG8GcbGz2wdgVlNTZR6A1UP:SS9ZGKd9rfG8GcW2wdgVD6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783977904, "uuid": "64c2c945-1ad3-43f0-a136-fbc757efa5b3", "value": 1247232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783977904, "uuid": "621dac41-dd3f-49cc-87b5-0d2035028147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977904, "uuid": "8eba3e9f-9dfa-4446-ae4f-03810b115ee1", "value": "qwe-23wq-e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e57793-7eae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783942257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942257, "uuid": "30bc69cc-e311-4a18-85a9-551cdfe997b5", "comment": "Malware payload (Mirai)", "value": "18e3b2a04712aed0feb7c650bb473775", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942257, "uuid": "dbcd7ffe-5092-45ac-b8d1-14cb122a1e1a", "comment": "Malware payload (Mirai)", "value": "369ba20c539b6a6e3d40c91c9f166ae9048a070a2eb2a5cbcd202ee183c9c72e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942257, "uuid": "6755c2b7-7fd7-424e-b930-68e4f03d91a8", "comment": "Malware payload (Mirai)", "value": "dc8cf5a3c4a2806d0f9997e73b72e1728431fb0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942257, "uuid": "89d1dd87-d2da-4766-b89d-9ae539fbe05b", "comment": "Malware payload (Mirai)", "value": "95059739505be0c385d6fa390ea366aaf738a514a6a57898e0ed935f43924f61d28b26591b23a0afbaeb2a97f91f888b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942257, "uuid": "9193f7a2-9726-46e6-b798-e2951f4922b4", "value": "T192C32989B8929A22C6D716BFFA5F42CD773663E4E3DF7107CD185B21338642B0D6A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942257, "uuid": "c0b22287-e660-485f-8b33-5ff5ccb27c17", "value": "3072:HEv3RX2BRU1FO3ciU5OWrLLXgjADAnbt:HEv3Ei+3cioDLXjQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783942257, "uuid": "2cd29343-a820-49ef-a551-45431fbc5369", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783942257, "uuid": "8cf1a012-d91a-4e4e-abab-1dda78526894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942257, "uuid": "0ee1e053-235f-4efb-a040-cfc921514695", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b086b3-7eb7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1783946214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946214, "uuid": "030a2d66-5f8b-4db0-af13-db41f161ab8d", "comment": "Malware payload (DonutLoader)", "value": "7ad92d692934b6f0aa8bbaec9a190623", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946214, "uuid": "4c297350-c337-49a6-b856-4b03dd008a83", "comment": "Malware payload (DonutLoader)", "value": "36be1045f8815b62ec98e7923fde383cbfdfd252e08bc3a5fa405268904fb718", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946214, "uuid": "da054493-0146-400a-807a-bcf19527b21d", "comment": "Malware payload (DonutLoader)", "value": "2eb2b06859c22964782523e157f490c77a7f9396", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946214, "uuid": "6763bb72-9616-4187-9193-496e25477bab", "comment": "Malware payload (DonutLoader)", "value": "cc0ef28c896ea7e2a2032dc3655ffd853ec2f93e9d42109e63292d0777c1216810dd3d165ec88cafd453ded1c9966121", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946214, "uuid": "07b725be-897e-4745-b036-e4761f51d424", "value": "T1A44523122FAF5EB4465C903CB1822B6887F3BC810C94E9FED6D135D70796D90BA8B9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946214, "uuid": "fbdd5749-d389-446f-a93e-f46db5fff4e0", "value": "24576:XmfR3TdA7bCf+KAfiQvSZ6KXrfextxvO1rvhulsKvwGYybuU/N0GUSnj:8v2VScrlxYy6qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783946214, "uuid": "fbf3482f-0121-4d0c-987e-67c164e0b4bf", "value": 1278751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783946214, "uuid": "4f1cb451-f666-4f48-bd92-794b69bcc91d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946214, "uuid": "8718d2cd-4f9e-42d7-87c8-3d0f9095aa3b", "value": "Techno commercial quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efb941e-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963245, "uuid": "7fb80f82-6b97-420c-8bac-9d013c0c60d1", "comment": "Malware payload (RemcosRAT)", "value": "24175f869fe20c9de7cac33e733d2ee2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963245, "uuid": "d560cb36-65e2-4940-ad01-84d85742bccc", "comment": "Malware payload (RemcosRAT)", "value": "37427ee8f03636381fe41c2549b9552b52a188540cc56c859c59bcfc63f2a9b1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963245, "uuid": "81e233f0-2366-439d-8527-a6d5e840fcce", "comment": "Malware payload (RemcosRAT)", "value": "8ab7e3c3849fbf947a33345db5822ed38c81e975", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963245, "uuid": "074fb596-70fc-4469-93f8-e6d7737c03ae", "comment": "Malware payload (RemcosRAT)", "value": "8bb8cdf95c3755387ac877ef9d64e8cc1beef729b07c45a33cbe64debf840657b301ab0425913b2e5ec1e90cc0f98301", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963245, "uuid": "cf29e2d9-327d-4927-a4ce-42ba2a4b2906", "value": "T137252332B7D0DBABE273543919AAC8D6001E7ED41F26D41F3174B31C37B86B485A662E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963245, "uuid": "f25873d1-9040-44a8-88d4-373673c43b2f", "value": "24576:MfwI/uhL7C8zX66/KE+SOm+9Rqk2sJQ/i6cE/IfJq:MfwIS757BKJ1F9RqwkLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963245, "uuid": "43fb66be-2ec7-4d94-b9a8-31fd375b9b0f", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963245, "uuid": "9de915ea-1046-4ac0-9610-2119e03c26cd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963245, "uuid": "f4c0329c-2e24-4c41-b450-71de05814fa7", "value": "Curriculum Vitae.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac99ac8-7ebd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783948904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948904, "uuid": "fe2d87e5-3716-46a0-b531-ab5202b206db", "comment": "Malware payload (Mirai)", "value": "04849cfcdb6e8229e4ed6f14cac4089c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948904, "uuid": "9c022f3e-38e4-4336-9ad6-239073c75a94", "comment": "Malware payload (Mirai)", "value": "396669b5255c2dd5cde66b1afe6cfc0a7b33b4f056e48c5a9e503ddcfeaae000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948904, "uuid": "7d84340b-956a-46ef-bb64-88bac091c7df", "comment": "Malware payload (Mirai)", "value": "20dffe1027ba8035ce98a8f357fb19ef712f93fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948904, "uuid": "9202d8c0-a6bc-4ab9-9a4e-48b706f9fbb6", "comment": "Malware payload (Mirai)", "value": "eefada737f79d4a4e395fe88b303d894b4670ec002909d73c00ddb3e092d42f8d7f8f0cbb89deeae4703d3cf949c5f5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948904, "uuid": "a824dcac-bf75-4a0d-85bf-d8385d8fe00a", "value": "T13FE3D50E6E394F6DF37A8375C7F74920AB58B38216D1C649C26CF9122E3424D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948904, "uuid": "3a3673c0-82e3-4605-951f-661be062a79d", "value": "3072:cNgQfXka1LLOakoAdWpQZJll0c8vFtM39HeJmNVL6D0MeDwgfw6DUeqPVgykbGzU:cNgQfXkMT6q+6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783948904, "uuid": "bb5ce4d1-4edf-4eb1-a185-5bb5a49d54b9", "value": 156300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783948904, "uuid": "35af8b29-4551-434a-8aca-8f3b471d890e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948904, "uuid": "8388ba21-0906-4982-9d09-3cf088c02ed9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2381a17-7ee6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783966552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966552, "uuid": "6591295c-437f-42e4-9ee0-bc8bc0edf5ce", "comment": "Malware payload", "value": "52cf976b44dbf932b7d28b8a97a7c27f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966552, "uuid": "cd31a44a-705e-4fe9-b552-f4171b481a6f", "comment": "Malware payload", "value": "39d21c33b65d3d58abe2908b4660ce4ca29f18068d7062c1c85fda21a85dce95", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966552, "uuid": "66661fcf-fdbc-4705-997a-14324687a2e5", "comment": "Malware payload", "value": "74dcb115015c9bbb2ba703ab2e45927c9f8f7a83", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966552, "uuid": "3a8e3423-0ea4-4926-af95-478ba5b7a687", "comment": "Malware payload", "value": "03a1fee08ff20509f6c86fc639067621130d1ca39cc78549ac5a4202bbf4d75c4677b6acb9a9b40f80dd0947d1f2df86", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966552, "uuid": "11c86272-0d68-4bdc-bbad-a36c3a8a4e86", "value": "T1DF235C6516857C24AE98C4361C7E2F0CB9AD83E6324452EE7FCB3CF68C4A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966552, "uuid": "6571ed81-ba3f-4fc4-9a35-8d26d42b2cc3", "value": "768:c+u9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:c+7cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783966552, "uuid": "d8e5725e-9c8e-4832-b461-ff102e57cb74", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783966552, "uuid": "c23abb67-7394-4b89-9eb4-e6acb606c717", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966552, "uuid": "e5a2c8a4-8983-4e12-90e5-ea2f35462658", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08945ca5-7eb0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783942994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942994, "uuid": "d1c4ef33-d2e4-4839-bc3f-76a30ab78323", "comment": "Malware payload (Vidar)", "value": "5cbb51cf747cd514eb333f402e21866c", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942994, "uuid": "b6791156-82b8-4af4-8bf3-e7452fb5bbbc", "comment": "Malware payload (Vidar)", "value": "3b328b13d6925bb86cfa46b58586530dd14e6f0f627ec92a1f14ef162d5712ec", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942994, "uuid": "3a86dca1-b04a-474a-9a70-169fb6de89fe", "comment": "Malware payload (Vidar)", "value": "6e1561e0b51a74b01a2e0377f52ea95a38e439fb", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942994, "uuid": "5790edaf-8965-4847-8511-3759303bbc23", "comment": "Malware payload (Vidar)", "value": "88da5a9c245c0af3cbf7bf35d57a4a086ff64c87f71df8f555296658c116d1bcfffb94a34795d8deef8932cfc354edda", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942994, "uuid": "224e5865-4474-432a-a30b-7e785d232e2f", "value": "T146856BE838FD2F64DA268B729992B437CAD2B42605796873C510EFC35DD2DAD1C9C312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942994, "uuid": "58e8370b-bf69-4585-a41e-bbd5a3ffcf97", "value": "24576:99uLX8bYMl4oOGGZNrnbkpm1ZNYXzlBbYJi:GbKYa+GGDDIs1ZNClV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783942994, "uuid": "898e2ea1-056f-48ae-a1f4-f49a35860559", "value": 1727488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783942994, "uuid": "1bdc8733-6a33-4db0-b585-42b7460df4cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942994, "uuid": "7acaec5a-5237-42a5-8b90-6600c8a929b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff3bc64-7eb7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783946362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946362, "uuid": "35f4d1cd-ece0-4d0a-9b9c-92f5c0687eb0", "comment": "Malware payload (AgentTesla)", "value": "210af5ba42d03a668758f75724074b3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946362, "uuid": "1bbfa72d-3c41-4ca1-9e9e-4fbbd0aebd96", "comment": "Malware payload (AgentTesla)", "value": "3bca9c81c17cfc02acd309b5f21322a1ae7044674db25c43105f237e44b502c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946362, "uuid": "7e21d261-a44a-4612-9c5c-229c2fd69536", "comment": "Malware payload (AgentTesla)", "value": "d1e59af86d6b281071b7340a32c3a6a3af198d5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783946362, "uuid": "d7d604e6-b849-450c-a08a-a37d39b2f036", "comment": "Malware payload (AgentTesla)", "value": "dd3812181c4cf83abf684a2a9122d0d59b0931258623fbfcdc50afc8f7222f5956b8b726b3e1af72e0263922098d2162", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946362, "uuid": "234cd4da-22b9-4033-b186-fea82992eb37", "value": "T154F5184047A861337721E79E413AFE389C1EA05368DACF11385EE238791DE4B9758BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946362, "uuid": "748aebad-185d-4272-a613-96bc21254a95", "value": "98304:JduBlmqDlpgSnCpz+vDNK+0lBTNPRmeJajMP6N:zut0hZv/goyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783946362, "uuid": "4b59c90b-db19-4fb9-817e-b7ebbf7103b1", "value": 3471310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783946362, "uuid": "30d77129-3137-4b57-8ae9-697090378d6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783946362, "uuid": "32a6a99c-7410-4b82-96b6-265eadcff211", "value": "MT013 Swift copy_Argo.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b76f06-7eed-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783969321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969321, "uuid": "e3a68717-e9bb-442e-b599-0e9e5f919d55", "comment": "Malware payload (Mirai)", "value": "6aa73566cc270fdf4e816150a528fb39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969321, "uuid": "783e7962-82c6-48da-8143-2476a36f3b8b", "comment": "Malware payload (Mirai)", "value": "3c137b5aa7f4ebd915927ada5c1a201d0dbf3d482a2048791ac60d349167db74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969321, "uuid": "8fba3aa7-db5c-4e35-82ce-4f911f976006", "comment": "Malware payload (Mirai)", "value": "68897f2e2ff9c6ba65ca88a09da7645fc4a1b467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969321, "uuid": "f2b23825-3484-4fef-89ba-7fa47dcdbb5e", "comment": "Malware payload (Mirai)", "value": "c1ec037277d141d2086d2c066d7638ca633e29e78ef20847396c5fd4edfae1a523835c91a8b52bcf46b3788e77ec0eb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969321, "uuid": "b8a42bb0-48b1-4d23-a781-82df38677c63", "value": "T1E1331895FD41AA12C6C1157BFF0F828D77264398E2EF7303AA256F20369786B0E3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969321, "uuid": "35e3e87a-dd42-46d8-b609-b79dfe778b3f", "value": "768:zOSSiI9lNMwwVVQGkbof3UMhVkwkleEOMyYiwDyW61bjpPPnWmjngRbI:YiIKLpVhV+eEOMZDJ6HnLbgRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783969321, "uuid": "4cf44eea-43de-4785-8f77-85ac2fe5087c", "value": 50372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783969321, "uuid": "dff84750-550d-43a4-97da-0854920fcdba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969321, "uuid": "3dd2ea2d-aa0a-4849-86bb-5c35e3d74372", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a04992-7ee4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783965719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965719, "uuid": "8060bdb0-2ca0-4c17-9f62-ce408af0be76", "comment": "Malware payload (Mirai)", "value": "13a5094a5e4087d08aadfad6835ba3a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965719, "uuid": "77fd136d-2d37-48d0-bce6-2fc77084d160", "comment": "Malware payload (Mirai)", "value": "3cf1f8d7848fdc5de0685bc7b46869ca30df9e0e776d1a485f27354065fcde69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965719, "uuid": "4df30eaf-07c8-4404-a4cf-a042abc7a3c9", "comment": "Malware payload (Mirai)", "value": "9f099afae93b360b249e4ab1269ca1fba070f84e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965719, "uuid": "a322e710-ac2b-41fd-b10b-1f6f960272a7", "comment": "Malware payload (Mirai)", "value": "79ae96a55279a44f53a6513cd6e5fa2bbe1979441e1d293d6689c73b648fcd7e00994d2fbfe52b025bc0ee06a1a22b3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965719, "uuid": "85a86222-9f08-4742-a69e-adbdf43e6571", "value": "T152B302277C43B9FC947B29B6AE7C5D636E1F05A6E59B20090B8DCBE18D4181D863C383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965719, "uuid": "110abc64-2e81-4a31-b412-afc48634f1c1", "value": "1536:WBTBQEQC8NMqX8ZD/3CVlazMDFKXLXNT6ZKRjI/vLomg9hhuVInDOJ6OST0TAm70:g9DKUOVl+pTaWs/vLomg9iV8SJ6OaXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965719, "uuid": "40d419b2-d145-4058-8fa2-8028d629e6cf", "value": 111744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965719, "uuid": "eefb933d-43a4-4bfe-9830-b28f801455eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965719, "uuid": "b3f0bae9-a4a4-41db-9ccb-cc3749bd3395", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b510ccf6-7e58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SheetRAT)", "timestamp": 1783905488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905488, "uuid": "4998b098-c857-4e0e-a090-059d9bfa414e", "comment": "Malware payload (SheetRAT)", "value": "dea25a6b76f660ff1d464c88ce57e453", "object_relation": "md5", "Tag": [ { "name": "2-27-63-115", "colour": "#FB09CD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905488, "uuid": "505cfdd5-dea3-4639-98eb-be86cb8aa32b", "comment": "Malware payload (SheetRAT)", "value": "3e1fb4cc6c8ce65e6ac79793cb7d482e6c18ba46dce36b0c51a259b511528d30", "object_relation": "sha256", "Tag": [ { "name": "2-27-63-115", "colour": "#FB09CD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905488, "uuid": "18fb9006-b7f2-4888-a7d2-b3071a445d29", "comment": "Malware payload (SheetRAT)", "value": "e114092df6873c703be1a785646b171948d37980", "object_relation": "sha1", "Tag": [ { "name": "2-27-63-115", "colour": "#FB09CD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905488, "uuid": "c193aca7-fd04-4bd6-9fe4-a4deb55aa82c", "comment": "Malware payload (SheetRAT)", "value": "57e6fad46fba695a9b9d9f8179e8aaa299d1e5bda40dbfa8c48d8f7175bdfbf891a180c10949a07ff72dccc783e82823", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-63-115", "colour": "#FB09CD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905488, "uuid": "7c289920-319c-4cfa-b1c2-b2bc1398a827", "value": "T13435CF163BF5EE01E2AA33B940A045D443F5E4199E86DF0A22D43AF36ADFF91DB06057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905488, "uuid": "bad99774-9f6e-41a8-a6f3-e73471aacade", "value": "24576:eOlOX6eCdBvm0+myIesqfFSZhGGtEoeJhkhfIkdb5:eOlC8H3Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783905488, "uuid": "b88b23de-eeb0-4527-b3c7-cd6686213663", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783905488, "uuid": "e91432b3-43de-42f7-92c4-7aeae9370a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905488, "uuid": "5752f378-f5ba-4278-82d9-88591fc56793", "value": "component_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ed6009-7eb1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783943533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943533, "uuid": "52697d6f-4358-4fd9-868f-582adf7afa7d", "comment": "Malware payload (Efimer)", "value": "0a6d724265d49486a917d7af4907cda2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943533, "uuid": "fe669638-1363-4004-b669-ddd4901e7364", "comment": "Malware payload (Efimer)", "value": "3e8fb7acab8a93b43f25cbdb63b4186057754dcc4a07bcd91fb5ca7090ccb9e3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943533, "uuid": "c894a80a-4972-455a-beb7-1cd54208136e", "comment": "Malware payload (Efimer)", "value": "ef1415db341fb693f3e5c71af5d5c14955bb95dc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943533, "uuid": "00f9ed02-bcc9-4f7f-b594-21dac5925f69", "comment": "Malware payload (Efimer)", "value": "964b4617b69c44fb6270cb4ccb00870222785e1e44b27138c16c861d617569fa18c478a35c14ba9a4927a5cd48e0584a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943533, "uuid": "97159798-6ef4-45f4-a845-bcba306deb5b", "value": "T1FBE6332835C017EEEAE7123DFAD25196E611BC728362C3DF27A48BD52D172E0587D227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943533, "uuid": "d41368cb-1475-4bdb-9dd7-4d09f17531eb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943533, "uuid": "dd5f646a-3073-403d-9ed2-e268a4a1a1ed", "value": "393216:n4W3Y3vgeXk9QWuPw2XMCHWUjX5cuI3/PGTAI:n4dvXk9QWV2XMb8XOH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783943533, "uuid": "8b5de23f-f32a-4eab-9230-177825b12364", "value": 14314488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783943533, "uuid": "547c4223-9e48-4eae-a5d8-c2af4a5ee6af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943533, "uuid": "e1e5ccd0-ba66-4aff-b86f-83e0092ac911", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435a6f2e-7e96-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783931926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931926, "uuid": "df5f7c4e-80ac-4413-82b1-98634ceffba8", "comment": "Malware payload (SalatStealer)", "value": "fcc1104a5b4508c3f0c1c467d88941e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931926, "uuid": "fa1d9c56-3175-45e6-96da-5d5778574694", "comment": "Malware payload (SalatStealer)", "value": "3ecae3266e1e24200de4a94f0ecdd504219d6de741af53340f65de9c8098fa01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931926, "uuid": "01df52fd-6c93-4b48-91e8-6b97f5aba35c", "comment": "Malware payload (SalatStealer)", "value": "9a2f37ff8710fe00d976d49179d9b9110a2b4e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931926, "uuid": "ced003f7-4845-42c8-9308-e26c060e130d", "comment": "Malware payload (SalatStealer)", "value": "bed42312c54219053867739cde83de3e412e372b27a42cd5333b46cd56c1e1fb5da829d10ed381606bb6f17df300acfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931926, "uuid": "f9c04365-f503-415f-91c0-9fa0a9ad264d", "value": "T14FC65B01FA8B65F6E9035831415BB27F23315D048B28DBDBEB583F2AFC776A1183A645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931926, "uuid": "fa02d997-4008-484f-b3f7-8ab427d819e1", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931926, "uuid": "8fc62f6e-2cad-41e3-90f0-90701a56f64e", "value": "49152:0XxLFxcRUsGTfTS5L4j2mWSqm/W1sDBKBkQfImdU3c7RAb1vLvktHNrCsWjcuncd:YFSRUs6j2h8/uYKAb1ort+4trBkEo/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783931926, "uuid": "421f1334-c1f3-4b0a-b7a7-f2119dd5df04", "value": 12543488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783931926, "uuid": "69d58e49-881b-4d08-84ae-b60df02d619b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931926, "uuid": "50bcf5b6-75b5-455b-ad65-6d03c2c57342", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.4108.32194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d62dd0-7ee0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963908, "uuid": "e1d00856-e600-4853-a1a8-17edd83d66db", "comment": "Malware payload", "value": "2423295d20bd767732810253a7f8d16e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963908, "uuid": "8d0cf454-12bf-4304-87b4-5c01dcfc599b", "comment": "Malware payload", "value": "3f9e61a205f9871644dd1b4fad4b96bbaa482824c7e9adf5f654a2f70058485f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963908, "uuid": "42697a7f-45e7-4263-928b-50ae2c384e75", "comment": "Malware payload", "value": "e54ac3fe325918d36ccbdf7637af2f9268afe4f5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963908, "uuid": "45457328-4784-4861-b23c-7b2a8b4834b2", "comment": "Malware payload", "value": "26e600f4c7a28212d4c6b492878922a83a42053db743735c53b336cc179d54fbc1171a605c64b24a3c453ebf9d9001bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963908, "uuid": "9e744358-21fd-4371-ba6c-f300fb657991", "value": "T1AF236D6616857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963908, "uuid": "f4da0a03-7f23-4ff6-b467-76705a8ce413", "value": "768:tXRWNGxVV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:XlxYcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963908, "uuid": "18835a46-d102-4eda-8028-7fe587ced1da", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963908, "uuid": "bd85be63-ab20-4f82-9ae5-8b07b8be89c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963908, "uuid": "a0213009-5107-442f-9e0d-a1f0e75e8afc", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aef8748-7e96-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783931912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931912, "uuid": "aeac68ee-7f11-49e0-8118-deae638a3f04", "comment": "Malware payload (RemusStealer)", "value": "1b707c3c5fbb377d78c06eff79829490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931912, "uuid": "b2ec5d60-36f9-472a-93fe-98cd04cce677", "comment": "Malware payload (RemusStealer)", "value": "4049128f0308d05dcb8d24b668f69238d720199de32ba0d8304cd3c3b3bde1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931912, "uuid": "8643f8a4-d22a-4e81-ac5b-716365bb35a4", "comment": "Malware payload (RemusStealer)", "value": "b35a83420c9d263788f785d5d0e0c64801521a52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931912, "uuid": "8afc8e7b-d9b0-4a13-889f-4fe1452f3c95", "comment": "Malware payload (RemusStealer)", "value": "da57755a0456e91dcca2bfa7d6c820874cb7f0b7b7b3b87da144eaf1801c58dabcaeeb9487c0fc0243bb7d72d38c003e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931912, "uuid": "6e938dce-5768-40a9-b7ad-134c8e983fa4", "value": "T1BE548E5AF79918FAEE77813CC9520505EA727C524761EACF03A04A672F237E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931912, "uuid": "80a42a39-3ef4-4d00-9848-fe193589b08f", "value": "67f6728bb9c2c56c262f6da70935d9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931912, "uuid": "cc18719c-fc48-4df6-841b-e3c564e09d43", "value": "3072:9kGRV7Cdu4praxw8PYcGZnNNqkL4QpHPiy8z8/y5smrwin8DKe2D/kS1g5edgMHf:FCTDQyZpH5e3pkIz49oUp6RwyGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783931912, "uuid": "8573d51a-2491-4ccc-acf9-006a212164da", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783931912, "uuid": "751f81c3-c569-4617-870d-f4d53a69e19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931912, "uuid": "770fff22-3825-45a4-aedd-2e47fd1b8697", "value": "SecuriteInfo.com.Variant.Yogi.20055.85337625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c14156b-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963294, "uuid": "e02dde45-07f6-4dd0-996b-99226683e5fa", "comment": "Malware payload", "value": "2013b487d05cf742cd46d9f5c50d7959", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963294, "uuid": "02836083-925b-44fc-abc1-cb51bc04d7e1", "comment": "Malware payload", "value": "4097b5940b43e3d52b92d4407b9d0b726cd1bd2f6fd2c340ac5117f42901c2dc", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963294, "uuid": "12026915-505d-4e1e-8de7-688f00ae55de", "comment": "Malware payload", "value": "26037d0f40b0e04d065915128bca9693da38cf38", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963294, "uuid": "86146cd8-fac0-4b6b-babb-14d5fa4bc80e", "comment": "Malware payload", "value": "53494718e137e70436ab0787dbcb53ca30def99a63353804a78957a9b0e4aef8fd230df13c0987c3935ddced6342a8c0", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963294, "uuid": "b08ce027-25ac-45d4-bc8a-789767a09a75", "value": "T11BF42315FDE5C723C239C4345DE88BB7511CFC685B86A29F3090F30E1B39BA191EAA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963294, "uuid": "5ac3cd5a-45c1-41df-b2a9-482c4dbdc9ae", "value": "12288:A+322SsLHMSCiAaLflE/MQUW4ptNy0xnK1zKaKlCFs0Jf9OifS6X0pQKU:AN2SsIFiLLflEBputK1zKRlKT9DX0pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963294, "uuid": "734c6d3e-a12d-4e1e-bbd8-24b4a2c2d968", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963294, "uuid": "ef88ec4c-90c5-4581-827a-ee487fde1e5a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963294, "uuid": "54c12263-285a-45ab-a65b-07564e34e765", "value": "ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5267431a-7edd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783962446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962446, "uuid": "a3aaf689-f146-41ef-98cc-b45a7ab0d4b0", "comment": "Malware payload", "value": "148e75303ebb5618ed07c98cc8ea4200", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962446, "uuid": "f94749e3-ba95-4717-a611-3071aa3c7239", "comment": "Malware payload", "value": "41b3e4f80aa2deeaf56c5181cd3fc1b2ee545d053d29934408bb17ddd7ea2096", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962446, "uuid": "ac5437d0-d851-4490-a98e-991191428f8b", "comment": "Malware payload", "value": "f89bc89ecd064cacbcaa495da3d07e41d1f5ae67", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962446, "uuid": "13609587-7766-4272-aa03-a7d18d2872cb", "comment": "Malware payload", "value": "109856f263411ca201941a5ab5c679ca747db77565e7330d2a7a8527de479a102d3c4762ca4852e0a3230848ee5b858c", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962446, "uuid": "cf30e8b8-03ce-4e22-9a0b-c93b2e9f7957", "value": "T17A2681127C0B0DC6F5881BBD01A87376DB8E8F128A00D3D6F2E158FBE4EA556C5593DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962446, "uuid": "9542803a-9228-4d4c-8d0f-3cb6bdacb0c8", "value": "846c60b7415e38d769a8b7a0468ed919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962446, "uuid": "2a49065d-f7b2-43c0-b19c-ed5dbf10e887", "value": "24576:Rf8wWiTSflSHvLZ8+BlnS2kASxaEplYZinCnNrXzdZs6D65axf6/jkPmdL2/HGwT:ZAlYJD7Dmd2hOr4PEjy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783962446, "uuid": "80dbe2fe-40a7-4ba9-98c6-871514fc9f7a", "value": 4860928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783962446, "uuid": "ab95731e-778b-485b-858b-6ef11c296e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962446, "uuid": "93d1ecea-1902-4d95-b07b-244693c04438", "value": "gc.key", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ae34dd-7f02-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783978265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978265, "uuid": "75aba917-f111-44ee-9c24-a6db2f3d3f32", "comment": "Malware payload (RemcosRAT)", "value": "94e1df21f51089cf6a9f5f59ec6c0d00", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978265, "uuid": "4fa3e2ae-4aa1-4471-ac17-bddc49b3ffdf", "comment": "Malware payload (RemcosRAT)", "value": "41f04280d3247586155c62404609431b378f99bd7c7aff4e711e15330ee978c9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978265, "uuid": "a6dd429c-150a-4624-a355-7f863c3c7324", "comment": "Malware payload (RemcosRAT)", "value": "47d8b23d30b7ca009b99d920a4d27e909d30b446", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978265, "uuid": "994543e3-0905-4d42-abf0-41d3dba6ed5b", "comment": "Malware payload (RemcosRAT)", "value": "43fbd32917ddcf93cf0063882c329ff2f161d1f42cd5e0f875978a14eb2211bbc9d22daaec3d0415246aed462ca25bb1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978265, "uuid": "1ec09ddd-f838-43bf-b3da-567b9dcea6f7", "value": "T19403E93C6E0481E7894EA05D2CB53A36241A517781AE9FA7348D0C73FFB65AD48B8C8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978265, "uuid": "242b3e8f-0c68-4f12-9087-655427897c52", "value": "96:fTVlyCeycOyZak+6Z1Uy1t6bjgdtIM5gdtIMmgdtIMUgdtIMogdtIMZygdtIM0gr:rVYICp+6T1t6bfG64MQlDzAmkpZSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783978265, "uuid": "372b0682-9732-4026-8e98-286ac878ac24", "value": 38297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783978265, "uuid": "915f2cde-23ed-4f3b-99f0-e2027cf492f6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978265, "uuid": "974bbecf-385f-46ac-ae69-2e7532b43c36", "value": "weneedbestthingswithbestversionsneed.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c8164-7e4e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783901295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901295, "uuid": "6d3bd60f-7662-4e59-88ce-394503ad3588", "comment": "Malware payload", "value": "6999acadf419ac12aea0439a797ac5c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901295, "uuid": "9ba752b6-39b5-4f2a-8c38-8300a13c986b", "comment": "Malware payload", "value": "41f967f412cf6e4508d930754664ca33026614378790725b672a7c580e167207", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901295, "uuid": "8a0d159a-647d-4876-bdfc-9a87840c0304", "comment": "Malware payload", "value": "c1d0438e82d97d54913267d7279b5e9f19c4a9dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901295, "uuid": "150b38c1-5d0d-482a-a198-8100500df74f", "comment": "Malware payload", "value": "1ecc551bb31ef932b20609a4fbf66a23799d3aaa3bd841ddf2b716897d79eee06b2e2597eeaf03b4f7959290d0dd0817", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901295, "uuid": "3985d606-4836-4ee9-87f0-e3c8fd21acae", "value": "T11EC27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901295, "uuid": "6db5fa83-305e-4604-b225-346b23a098c5", "value": "768:c8vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:c8l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783901295, "uuid": "4fee3bc3-3e3e-43d0-8017-c371747b7757", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783901295, "uuid": "89a9fe20-ada9-48d9-9cd8-773fee771c66", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901295, "uuid": "ede9f623-86ee-44f4-93f3-fdd1120bfd54", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7f80e2-7ee4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783965363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965363, "uuid": "18b52bb7-3d14-4a6d-a7ad-1b53f5df5e8f", "comment": "Malware payload (AgentTesla)", "value": "cd14d2460ed0b968499bd8f7a1133b54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-telewatte-pe-com", "colour": "#742A09", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965363, "uuid": "8cfe357f-521a-4da2-be23-423ff05b4e94", "comment": "Malware payload (AgentTesla)", "value": "421798ea7bd98b7027ae3965fba2e50464a5c8da3d0b5f77e7bfded1e3dc01f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-telewatte-pe-com", "colour": "#742A09", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965363, "uuid": "eb2a8afc-fe80-463c-8791-152650548bbc", "comment": "Malware payload (AgentTesla)", "value": "9af50ed498012828b892ba8eb3500e7b89a20fc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-telewatte-pe-com", "colour": "#742A09", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965363, "uuid": "7e601b4e-4f7d-40fc-8532-4c5389ff91eb", "comment": "Malware payload (AgentTesla)", "value": "84078982e76f593d4d5ec634cec5cf8a3eae1502b03dbcecc7410966406f994ae80c3675c95877232ceb93708748ecb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-telewatte-pe-com", "colour": "#742A09", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965363, "uuid": "9770e708-ceba-47c5-9d1f-57a283ac8a71", "value": "T1E0F5294193A5A5377321E7AD523AEE3DA40E500328EACF04345ED638791CE9BD349BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965363, "uuid": "de710d32-d584-4552-b8a7-123c5184e109", "value": "98304:tTxA2NAr44fMNVIIA/aYXYXPBOd41IazLJtk9Cg5zpIpVj/Wjl6IWM:tTxBNAr4IuVzANX0l1IuFC9CWzpIjj/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965363, "uuid": "dd98d217-49a4-4ab2-9613-c39d0f3f5992", "value": 3469494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965363, "uuid": "a25bd725-9a2a-489d-a76e-9154cda435e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965363, "uuid": "e225d808-e6d2-4d0a-a580-8afb497890ba", "value": "justificanteTransferencia.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66006312-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783963337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963337, "uuid": "39c2ae17-be49-4760-8929-b09fb4f9a500", "comment": "Malware payload (Formbook)", "value": "e87eb0b055f81acd5167b817b6c4bd96", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963337, "uuid": "ce855642-d2e8-4f1d-a20a-2550f1ef4d48", "comment": "Malware payload (Formbook)", "value": "42255ff1914882e20ddb9116b521287dccd2bee944e056bc8f1bd1c2970299a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963337, "uuid": "954bee95-6666-4e76-a03d-bfb78432a45e", "comment": "Malware payload (Formbook)", "value": "19b550354b493af8be565a3c30b927bb6588b6ea", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963337, "uuid": "6a970beb-e308-484d-892e-e8f2ef967689", "comment": "Malware payload (Formbook)", "value": "641a849336b3b6c73cb1ec66d95c58cc29695bf9195f326e7d8dd4768a814fd82cdda9691a3154bd8fdfc5eb86831a51", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963337, "uuid": "3d286a78-2e13-4466-9381-768aef179da0", "value": "T134A533607C760FD5C12D00FB82417269696A05FAF72097FF897B93E89CD50A76EC06E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963337, "uuid": "249d3728-9144-4f68-9493-4d6bc224d4db", "value": "49152:xPyqcb1KIss6Ri1CB2Cw8oYRq75Npv8SNlbDPLP7mPFFaoz9GW3r45:xaqcb1KIT6nB2Cw8675XkSNdzfmjdRGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963337, "uuid": "b4f63498-e30a-451f-b37f-dda9a12e19d7", "value": 2215144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963337, "uuid": "36acf0a2-4db7-461d-bb14-345666b8b6e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963337, "uuid": "f11ba98b-d56f-4030-b94b-0e4770a9d1f3", "value": "NEW ORDER & SPECIFICATION.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a2a40a-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783906205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906205, "uuid": "df1c5e8f-6b61-4ebb-955a-719ce45a384d", "comment": "Malware payload (ValleyRAT)", "value": "c9e798462943f33ef81ee2ef2406b83b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906205, "uuid": "dafadcba-ae29-4608-bf25-1463ee756219", "comment": "Malware payload (ValleyRAT)", "value": "42420ed30965b2e8cd0abfe59103f9352cf9e8bb9a1c75d340bf13b2660abda5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906205, "uuid": "9adcaeba-9c39-4f46-8a9f-21d4b2611796", "comment": "Malware payload (ValleyRAT)", "value": "97c8100c3481d6b5cd4597ae3871ff0cdbb1e5f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906205, "uuid": "8861bf4d-2ea4-4420-b6ba-c8f7a7643202", "comment": "Malware payload (ValleyRAT)", "value": "0fcfccec0e96342ed41f7f99abf0bfada0fb386dd2ecbad2d53679ecc85161e7ae3044321d978d7c0eed30af6d02efde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906205, "uuid": "561a51c6-eac5-4dfa-905b-db7e560aeeb0", "value": "T1E6B37B2172E0C072C097253199F9EBB24A7EF93103B854CBB7E8167A5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906205, "uuid": "ecb3aea1-9553-431a-a35b-40fcd84ac963", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906205, "uuid": "ff58fcf5-a0ef-4816-935a-c5392cdf9473", "value": "3072:0XFiAVA5v6if7FMwrrInnjpE6Ux68XEPK8NcN:yFih5v1mwrr0Xt1y8Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906205, "uuid": "24f17b21-e091-417c-a92a-24e5fa773cb7", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906205, "uuid": "2138b294-e697-4649-bf8b-5261f4d70088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906205, "uuid": "3796c73e-e9f8-4a08-8008-fcb547ffd62f", "value": "42420ed30965b2e8cd0abfe59103f9352cf9e8bb9a1c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133fb275-7ee5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783965776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965776, "uuid": "bc7479fc-5f3e-48d6-b462-924f65e8fc0c", "comment": "Malware payload", "value": "fd466f9dc7bce74c9feb00fd614c9ac9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965776, "uuid": "b02c0efc-85a1-4812-b72f-a5d61bcad629", "comment": "Malware payload", "value": "435f496a7e937b1bcccfd9f49d66daf69049942f00e5a11fb1c32f71ba978fde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965776, "uuid": "edec0493-0299-44bc-bed4-665e4d695053", "comment": "Malware payload", "value": "a8a3d4b63682d9da41e0c1c619209ff06b8c6a4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965776, "uuid": "7b8e845d-b854-40ef-967f-5588563a3695", "comment": "Malware payload", "value": "819e6fff8f13158399ff6f2b92e75ba70f8a3d92cac9f9fde85fbe6fed43e44d88c3cde5bcee4fb907f0334fed29002c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965776, "uuid": "c550aeb9-90ca-4863-9a95-28e765d0f10b", "value": "T127A312E8AFEC7CC1D3692E74818D5240168576B0B2BBF9336233D9A692C1D4463B9707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965776, "uuid": "490e7447-db09-410d-ab7f-82a0ca520ed7", "value": "3072:8jgYH9rF7uWW1kvZGj0Zvc4Rta4/+xxo5Jr21b:4V4WW1WnREx2Jr21b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965776, "uuid": "ddaaeda7-63d8-41ac-a2d5-81625cae38e0", "value": 101488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965776, "uuid": "6b0e480a-88c6-4ef8-ab2f-0663c7e3283d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965776, "uuid": "e696eb1e-3076-4d93-97df-81e15bf99c03", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acda71b-7ee7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783966674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966674, "uuid": "4b264cbb-cae7-46d7-9eaf-a1cb54f327cb", "comment": "Malware payload (Mirai)", "value": "25582c5a6ed63c594a58e0cf119e1de5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966674, "uuid": "e35f8baf-6e02-4edc-ade4-7126925c6c10", "comment": "Malware payload (Mirai)", "value": "436f9df181fc37d9b278995235a3819af6aa1251f6b790c541002136c090f00b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966674, "uuid": "52defc09-2d97-43a4-bf47-04cba4f82033", "comment": "Malware payload (Mirai)", "value": "cc9abc1dd168bc6cad4cbf78d2e8ff85192d4424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783966674, "uuid": "8b2acb49-a916-41ce-ae91-156a39ed1563", "comment": "Malware payload (Mirai)", "value": "104bc5d237877add76796255b36c506728dc67828d8a9c3578e262c0454d0f0f8e5d83578c4d0ec971e52edf8e05fd50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966674, "uuid": "cd2c70c8-46f0-45f2-ad02-0851248d44d5", "value": "T151D3078AF8819F21C4D612BEFA4F518D332367E8E3EE7112DD245B2477CA55B0A7B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966674, "uuid": "82830746-bbf5-447b-b4f1-cf78cf8bd218", "value": "3072:Ixr0ks87LO6T34Nc4uPOs4tsFzuaa4KaLaOrKVQ72O0KJ5dqxnbWq:Ixr0G/hTINZu/4oyaa4KaLaOrKQIKPdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783966674, "uuid": "6f998435-6152-4f08-8057-55ed3c28313b", "value": 140860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783966674, "uuid": "0b587fd3-f109-4648-b313-e2f31bf064db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783966674, "uuid": "8e67df68-0a2c-41d3-8b96-9fe64a8ffcb6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551f5124-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783963309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963309, "uuid": "ebbda125-d02b-4988-8bb4-822d21702317", "comment": "Malware payload (XWorm)", "value": "997d3533aa9210c4091c19a25e3eef10", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963309, "uuid": "a24f1985-381f-40e8-b1fc-7b5cfd2598dd", "comment": "Malware payload (XWorm)", "value": "4378723bbaa2ae5af38272974f1f5e2987ab05bbf52c0a64edd56f027be19bcd", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963309, "uuid": "2e34040f-9a3a-40a1-ba00-e56ef8285021", "comment": "Malware payload (XWorm)", "value": "d9788b9215a128f8c0090d011730bb97aecc9cd0", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963309, "uuid": "c35fa6ff-291c-4a2e-bd6a-6f3e9fe3f963", "comment": "Malware payload (XWorm)", "value": "7ed6544a4af90cb369112d351bfbbe474700b428bf3f4b9bb5ec1db1fdf78a338d8d0ae308c758fcfc8bcfa0cd170eab", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963309, "uuid": "17828bf0-d708-4aee-a862-2e8d5c369067", "value": "T1E7E312AEE93D5A07D5778831C5C8574AF926D2CC11A4B2390BC0872FB6CA0939F897D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963309, "uuid": "769188d6-351e-4741-bdf0-07fd965f8c95", "value": "3072:MERwd9zQq190bd+O3hnfd6ZclHy/8dalPr4BXHE3+v6uiOZ3ZGgToOqknO:ttg0b8OlgZAHNaZ0BU3+v6uFbFqknO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963309, "uuid": "39268ea9-980d-4d68-ba5a-d5ec32836b8b", "value": 145772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963309, "uuid": "577c7ff2-a05f-4fe5-9157-e482b3e6726d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963309, "uuid": "bdbea84e-80e5-4d72-bbfe-cef4f56981f9", "value": "Purchase order_090.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3819995d-7e56-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783904419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904419, "uuid": "0001b6bc-815d-44b2-986c-1c75ec981cf8", "comment": "Malware payload", "value": "3bab007dfeb311771c1eafaa73704cb5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904419, "uuid": "448d999a-bff1-4006-8109-14b649119a79", "comment": "Malware payload", "value": "451459c1bacaf827202c376e4060477ba9f4aafa5fdddeb2cc3918c2bfcd6ac3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904419, "uuid": "cc5b4973-1c05-4519-b75d-f394803ca9fe", "comment": "Malware payload", "value": "34d032a5e6eb5ea75fdfab2c82390722201f081a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904419, "uuid": "e7051afa-acf2-415f-bb5c-a7afd2674109", "comment": "Malware payload", "value": "5ebfa1ebc449d4eea3c47c6478d0ef27c4bf8651d578dbe3fd080b4b5c3e407b30e821da1e2947379a8a1f00952f5ebf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904419, "uuid": "c4896844-5177-49cf-b239-8671f6d61794", "value": "T16301AFD944405C4080A9995C21E75494F410C3CE194B4F75BF5C6E3DEB8CD14B03AF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904419, "uuid": "fb4d3cf1-e393-4cc8-996f-6c10787b7c66", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkai8CFn9CDpTCXviFSCeE/l0FCs3YX:kXCKysE2hi0ziQvZoha32w9i5k873YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904419, "uuid": "19d38046-b5e8-4225-acb5-a81bff096158", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904419, "uuid": "10498172-3857-4caa-bcdf-f45c717bf10e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904419, "uuid": "58f3188b-fe8b-4409-bf87-efa865d52a78", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18343560-7ee0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783963636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963636, "uuid": "93a762b7-d43c-4fb5-be0c-a0f364aa4b4d", "comment": "Malware payload (Mirai)", "value": "8a3609f6e5f5cdd0d60d2f925d789d31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963636, "uuid": "640d7ba9-4ebc-4d89-a9d6-ba2f4f3fef25", "comment": "Malware payload (Mirai)", "value": "4571a90beb2ac992b30abd51e259ae40478a010aa040bf2b3436a7c0099007a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963636, "uuid": "1ceea0b8-afe1-40c8-8fd5-7b08c6930ef5", "comment": "Malware payload (Mirai)", "value": "f99877d8810c6f5282e23227a13145ff20bbeba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963636, "uuid": "972aacfd-f51e-46ca-bfcf-598759ae06aa", "comment": "Malware payload (Mirai)", "value": "d76f68194987694302e959e27bcd21185f4b0b411174b0d17cc856c5070f0cd16db0327de41cdbb723eeecf60cea0343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963636, "uuid": "27ec8b6a-461e-4ecb-896b-370e9a47f711", "value": "T1B473085AFD41AB11D5D625BEFF4E014933534B6CE3EE7202AE209B2523CA92B0F3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963636, "uuid": "997b35d8-72e1-49cc-a81a-84424c6814bb", "value": "1536:WJnMV3OpuaXPYWv0aLxScuMZS8ElleUiFL+PS4qq91TZh1ogRUkR:qpuUTv0aLxScuMZpvL+PzqqzT91UkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963636, "uuid": "13f4e28e-0568-4202-9053-db19e0a12c15", "value": 77360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963636, "uuid": "903456c9-8a53-4eba-a145-41633e0d9f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963636, "uuid": "ec8b28e7-98b2-4e3e-84c3-4a3125f0d490", "value": "SecuriteInfo.com.ELF.Mirai-DJO.32275565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd991f21-7ea2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783937285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937285, "uuid": "3d80762c-17fd-41b0-856d-d60c067ce245", "comment": "Malware payload (njrat)", "value": "8043b87976309cfaf0ccff63f629b9b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937285, "uuid": "9996aec7-0fcd-4b8a-810b-a1b6f9c43dbd", "comment": "Malware payload (njrat)", "value": "475774774c013c3a5d6db3ccdb025504c7151999a63097bf98476578d0533f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937285, "uuid": "c245b127-ec85-4d47-96e8-e87c82c647f0", "comment": "Malware payload (njrat)", "value": "116e43d5451e060b48a892e46a6f83e0374bde3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937285, "uuid": "0c7e846d-9595-4059-867e-ea7bd53f17c8", "comment": "Malware payload (njrat)", "value": "65b20d408b4a80b5769ff8a5eb0318a486c1a2ea3e2de45a6e0a2c03376206f4567d2552e645f5970f40575efd0c7b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937285, "uuid": "17fda79f-052c-4901-8290-c6a8bfd0195a", "value": "T1A8F6BE1893880AFBD52BC674C665D332E7F178864735DB4B1988D24F2F7F6908E6E221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937285, "uuid": "620758c2-1e26-4525-b9bd-c53a433c7c91", "value": "0ad5eff642592def3a09cd990fc367a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937285, "uuid": "ce7653f3-2ca2-463a-9e5f-06c52caf6f27", "value": "98304:cUMYsabSjCmrVHmRcAcTNJsDgbqMD195DjbPghwC51a/H2Sg3cpU/CmV0Nb1BCRH:czgomRcAMbqQaa/H2Sg3cs0JKoCLtdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783937285, "uuid": "f8175409-3dc2-4e54-92dd-44e2a36f4fa3", "value": 16765912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783937285, "uuid": "2e8cdce2-c573-45a9-b575-42bd584ea192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937285, "uuid": "87641e41-5505-4730-8b79-25dfbbb267c7", "value": "Build333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bf801b-7efd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783976462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976462, "uuid": "426ad241-d6a6-4ce9-8352-0263d1afb70f", "comment": "Malware payload (RemcosRAT)", "value": "3742ad85877e2c70bb25b59b0c38434a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976462, "uuid": "5216ec36-9b3c-445b-a871-9fbd3cbf7a7f", "comment": "Malware payload (RemcosRAT)", "value": "48dbf74443280fa3f68e0cb00c2c482f5692428b56c95f44ee0246aab27e3cd6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976462, "uuid": "62c15e2b-478d-4d4b-b7e7-6780ac261e2c", "comment": "Malware payload (RemcosRAT)", "value": "472759fc8cd4edcbf29dff9abb209ba9e8fe1b4b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976462, "uuid": "0616e075-3a05-4f27-95a8-75998f6401c5", "comment": "Malware payload (RemcosRAT)", "value": "c70476876695560b1db6b84476f39013aba417d35e8c6804c62da07962549e368bd229b4049b04b84678f8069fa7f03a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976462, "uuid": "c6f8fc31-6d70-4dbd-86b6-3adc385e6a76", "value": "T14D031B77C1885CD7846640BACC1EEEFA3007099E100105B8FDEE1DE5732B16B5A7ABAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976462, "uuid": "d24226df-1172-4a87-8ea8-b8a7d3e0b812", "value": "192:r3w87eSepeVcww2eIoNoeMQwoejcJWULyoTwewXedG:r3F7LIqc12hoNovQD4cIULyoTdgAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783976462, "uuid": "aef2e239-068e-4c7f-b808-08657d077d88", "value": 38395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783976462, "uuid": "df9e2fb8-f906-403e-8e4a-9426761c5454", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976462, "uuid": "ab3ee032-380b-46f7-8658-9c33f4304621", "value": "bissbetnetorkingmarketthingscomingfor.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176be1be-7f07-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783980385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783980385, "uuid": "1799587c-3a3b-4ad5-9fed-f7a5c219fc2f", "comment": "Malware payload (Mirai)", "value": "7d0d70272e1f86b9f22b27d9001a3456", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783980385, "uuid": "bd747e43-bdb8-4692-9b35-668b9c76ae76", "comment": "Malware payload (Mirai)", "value": "4978da802792479e84ccf497a16f7021096cf2cc0ae871c25fb62e60d6a63f5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783980385, "uuid": "f87e329a-0ba2-4432-b3ee-a820929f6c7a", "comment": "Malware payload (Mirai)", "value": "80f800d081dc4403442b72723febdd773d94c322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783980385, "uuid": "c35ba2cc-8d44-46c7-b3f3-f52d0bbafd8d", "comment": "Malware payload (Mirai)", "value": "e9d213529157ec5099a2c55fef6dca67e1700a82452827ef7c4824a3eca8636548ddaae2e57d8d7706a475c21254a8fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783980385, "uuid": "91c72d67-d544-4442-aff2-f9ac786ad6ed", "value": "T170B312614AAEB856C7BA2237791D812130AF675CEFCE5376F254E6C0895382223FCD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783980385, "uuid": "beee447c-a1d4-4429-9227-f41e04453383", "value": "1536:WgQBimNIGc69af5Wc183EYr7Bbcj1Helr++1tykTUo72pviLJ8l5st9q/SLRCq8V:TCiiIkcSEYrtYHwtbUoCIAI98XJv1Dk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783980385, "uuid": "1c98440c-b068-4bd6-b980-59472c1581b4", "value": 112704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783980385, "uuid": "2b6cc8b3-69f7-48d0-b3b1-89e4192914c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783980385, "uuid": "84968600-5010-40dd-9b0c-52cf910c2a13", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17db521b-7e55-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783903936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903936, "uuid": "2facc543-3d10-4f58-999c-4818df826c61", "comment": "Malware payload (Efimer)", "value": "22fb2d30626d382bf149340e1c05f31f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903936, "uuid": "0f2a7ed2-1d92-4d77-9fd5-d02a32c633ef", "comment": "Malware payload (Efimer)", "value": "4a338c6ca796c18dea79e298ebd3675703c198af5060a6f18bc7eb07fcd89a8b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903936, "uuid": "521e533c-38c0-4367-b155-62268e8e1e9e", "comment": "Malware payload (Efimer)", "value": "7c601de7e06ddd56313e3b0223d944692389ecec", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903936, "uuid": "f0b82aad-4235-47d9-b9a2-3a58f33bd1b2", "comment": "Malware payload (Efimer)", "value": "ccc46d32c1e16f19c4c4fe6845838e262d9c06fe5ba58761a8dbd01b08ff750e6ca3306ecec7b200a316408167304773", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903936, "uuid": "c4f88c49-ac9e-46b4-b78d-fe86178b5cae", "value": "T12BE6332492D122ADD773A13D7ED152A9D0ACB8B54B32C98F13DC82B17E672E04D3D61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903936, "uuid": "dbe9c499-75ea-41e3-b72e-90078816ae4f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903936, "uuid": "dd2276b4-dc5d-47a7-895c-fad0e091a1aa", "value": "393216:9o5q+BVoT32L146DVYcXMCHWUjXVcuI3/PGTAI:9TQm32L14C5XMb8XiH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783903936, "uuid": "1528a383-e537-4ca6-8fb2-767fd6121594", "value": 14313239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783903936, "uuid": "02700fc4-b8b7-43f6-b801-18e29cd7ffa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903936, "uuid": "47d05466-1407-4d55-a0f4-81a6613f3d7a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fe6d3d-7ee3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783965169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965169, "uuid": "364501b5-3e9f-4ea7-9a98-90bb81495fc1", "comment": "Malware payload", "value": "922304995fff0cac380276a39a3e88ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965169, "uuid": "5eb5c79f-c3a4-491b-8153-ab5ce458e0a8", "comment": "Malware payload", "value": "4bd416d58b21d19d81db3da8256f2c68b3770cedb27dde7c74e5cb43eae2442e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965169, "uuid": "c9e909bd-0bcb-419d-aff2-0d58d2b0d85c", "comment": "Malware payload", "value": "49e56ff56339c40bcdf469af9a9178ca0d1dfb3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965169, "uuid": "8510507a-43c7-4aec-b300-c7f92e1ce26c", "comment": "Malware payload", "value": "9e91094bf7dcf45eb8043344d748278273d6cf1ddec0ae5934512948995260bfe4e7c036b61b86bb794823ab92777026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965169, "uuid": "334c035c-7347-4963-9f0f-cb3a20ef0279", "value": "T10BA30262BB7E93B288A05E3219F76232B400F26ED4913DC5DB65721336DD6B724FC641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965169, "uuid": "04630ec4-c339-4ba3-975c-a352c90e1f22", "value": "1536:NYKufXyB4EuKbpCJII8kl2p0zuMxzVM5qzz1smaDAufDbvj0aXkeYxWKO9sh:NuKBvuKwaNKxxMyz1sFDAiHlKcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965169, "uuid": "db2f9b8a-fd61-4df7-8937-360abd186afe", "value": 105720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965169, "uuid": "dbf517ac-209d-4634-8819-690d2ac24bcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965169, "uuid": "dfdafe2b-56b1-499a-b4b3-63d1ceb06d54", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4361b32-7eef-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783970394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970394, "uuid": "2573a238-5f10-4c08-b9ac-125e6947191d", "comment": "Malware payload (Mirai)", "value": "ac4f59c2ef55f8e7273a0184f0120351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970394, "uuid": "7f2e3ac1-1b14-4076-af1c-1d5a593b2e81", "comment": "Malware payload (Mirai)", "value": "4bff43d7576d4b037cae2af1eedffb2c09d19211312d2920db6e840c8528a1ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970394, "uuid": "f114a9a6-ab16-46db-bc84-3f72592f77b4", "comment": "Malware payload (Mirai)", "value": "c922c060d80564fe405c9f0d934b92f952e3ac88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970394, "uuid": "9b3362c2-3334-4cf1-850e-1b6e45420f78", "comment": "Malware payload (Mirai)", "value": "e39d5e120b934b3c4ce8a48a2f7f0404b3dd87189eef2fc2900d3f4cc98ba18d02fd773a60192863106a0b4cde3c6fac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970394, "uuid": "53ea6544-34c3-456a-be9e-f5405219294e", "value": "T1A6C31210CA559B6DF1F2067C2388B76BE1306B6A1350EDCA136BD3D73A2E081B6B7174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970394, "uuid": "79cd3e08-362f-441e-9d14-20c3e0a1941a", "value": "1536:gnLxtt+jNe7Wf9jzuLwtJefHbZ3bFmkBc/mYwCHt/53h5EVSB:29/+jwWF/l7MHbZrFmKcOit/53jEVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783970394, "uuid": "ff032615-1f9d-4b56-bf8c-e8ec909a7c9d", "value": 119068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783970394, "uuid": "44ad1d2f-49ea-42b7-b3cf-79600223b595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970394, "uuid": "f18e4249-6c33-4983-a812-d27f4c52ba3a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47623a56-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783963286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963286, "uuid": "1f9d7cf4-9de8-4cc5-8d41-8f1b153f30d4", "comment": "Malware payload (AgentTesla)", "value": "8b9a32e5a2a18fd0de688c43a0263728", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963286, "uuid": "b84e5c79-c474-4b26-9659-2bab2948f8f8", "comment": "Malware payload (AgentTesla)", "value": "4dd072326c89842129884f2c08c7f36d2b0bb11cda79987db5c9cbd927869d32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963286, "uuid": "1ffdb349-c596-4af1-947f-d34eb8b551ee", "comment": "Malware payload (AgentTesla)", "value": "211e847198b6e1a04430a5a79fb81e04f0c675a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963286, "uuid": "efb534d7-8003-4fe7-8f5a-b3871d6f78f7", "comment": "Malware payload (AgentTesla)", "value": "cc15cd8d9e587a6a61b02502ef46cb04624c850e61b0745d9e50c95bcc727a0c581325b83f12c142919bc34402aa7209", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963286, "uuid": "b7134ecc-d7da-45e8-b61e-c2d32eb11f6c", "value": "T199427CCBE593182DF707277BE4801944CB303C9249173A6B33B4D08CAD662E71F5AAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963286, "uuid": "86c24600-f8b4-46d0-bda2-a4d6f084f2e5", "value": "192:/K1w+lOV8vdQjmMSFEJLoaRqX+IPYDMu1e6JVXgeBYuW//KbdMKOLeDoLBN:/K128qmMS1aIuWYDn4mVXeuW/+FMLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963286, "uuid": "7f6ed3a0-e10f-4839-b891-9358c61000a6", "value": 12117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963286, "uuid": "97f0da7b-39bd-4568-8e2d-396977e0068b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963286, "uuid": "ec76068d-45c0-44ec-8c67-af30b5586559", "value": "proforma invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b45ac10-7ec4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783951723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951723, "uuid": "7fa4ff05-c8d3-44b7-bd31-875e51b20a46", "comment": "Malware payload", "value": "9635ecd262c12b5ba636defa82b28e1a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951723, "uuid": "3f114b8e-3b57-4005-8d34-68506b0e4bc0", "comment": "Malware payload", "value": "4ed018e36ae028df2722f3f6370d87f47640d337261c49bcba40e8f71327ffc9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951723, "uuid": "14adb937-265b-448e-a0ea-428cfbf5f519", "comment": "Malware payload", "value": "b7b438c0c7d416a54f89a9d366c44d558398ca0c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951723, "uuid": "afbda7f9-f324-4588-88b2-37fc40723f00", "comment": "Malware payload", "value": "ec9efe00f15943536cce5d7fab84a21fb26abcca74cd08bb5ffe6229425f2306797449b10438eac931364407ad271030", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951723, "uuid": "5f5e19b8-d936-4793-8d2d-b4530e13e887", "value": "T1B6E612F37E4A353DE06A0A357A72953C543B6E606C124D0A86E7F45CCF395A03E3A746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951723, "uuid": "317e914b-d6ba-4d50-8b97-8416e710f3ab", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951723, "uuid": "741d8116-dd47-4946-9ab5-93d4508b5f59", "value": "196608:Tn2v7hBqK7d/43GTKCHTqY04e6LMNpa6/TO:TAjq0+3G7zzoE6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783951723, "uuid": "5d40973d-98c9-4734-ae7f-fa3eb1dfd7b5", "value": 14289601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783951723, "uuid": "7dd3ba2d-1be6-4405-a743-bb652834af88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951723, "uuid": "af538412-0ad0-4cd5-80ff-a80029eb7549", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26271f11-7e90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783929300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929300, "uuid": "57f82a49-9e66-418e-abb9-7b0d82ad4e69", "comment": "Malware payload (Mirai)", "value": "0109b708f8812d1f16c12368b4aaeee4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929300, "uuid": "a8feac43-08e8-4162-ae96-2a1a88498a7f", "comment": "Malware payload (Mirai)", "value": "4ee246fed8f027f02603657921e4cc60340ca0f4971139fab528b93f75a5c8e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929300, "uuid": "9df75f16-2cbc-4a84-b6d4-9315498575e5", "comment": "Malware payload (Mirai)", "value": "6f36157a5d7e9462fa49dac78dd3e5a7216abadf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929300, "uuid": "91052189-1b63-41ba-8ac2-f1052e651dae", "comment": "Malware payload (Mirai)", "value": "a433b3e386237df1bcf5ded7d08285f24f239b34e3700fb767292746b32c7fcfdd26a31aba98fdee183181dcc0f272f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929300, "uuid": "3d08fcc4-7f42-4444-8cbf-ade2a515467e", "value": "T127E37DA89E0E7DC3C2C3E2FE9D060F56303635744A64C2F66D01A2DEE79EDD698B1421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929300, "uuid": "915f96a1-107b-487d-a88d-ab7c91959cee", "value": "3072:KlTz7YKrverdmpjlM00/odL9R+TYU+UtRGyx9KhR2p+:OvfT+wu3odL9Rk+ObbKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783929300, "uuid": "eed7abe6-13b2-49ea-a66f-c8cc1b684b90", "value": 153576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783929300, "uuid": "b77f1ded-13ce-407e-b6c1-16b5fe6c5e3a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929300, "uuid": "20e227e2-30aa-4d33-a312-94e2ca84e190", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0783f264-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963179, "uuid": "0d677ed7-b8e0-47a7-9542-bd632ae431a1", "comment": "Malware payload (RemcosRAT)", "value": "736abe66cb60a119533dfa4a4b99057d", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963179, "uuid": "9e430c46-e56d-42d2-9127-6e2853df0a99", "comment": "Malware payload (RemcosRAT)", "value": "4f6dd60272ddb143ff7d62ca1d0acf127e7333254089d64bfbb768dc288fdb89", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963179, "uuid": "d9633014-dfc2-4714-8bf6-90fd955e9fb6", "comment": "Malware payload (RemcosRAT)", "value": "3c5cf8e5638c46a431604f08900ada9ac8e777ed", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963179, "uuid": "337a1132-e2d8-4e72-903f-d3ca5f415fdb", "comment": "Malware payload (RemcosRAT)", "value": "58924e70b323c3c46d9cca9185ef899c57721070fa976ef0805c7bb907ee766dab9ab5b148bb8b83233b880ea823f0d0", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963179, "uuid": "0917ff66-e67b-4867-aef7-b21872432aa1", "value": "T117F42322BDF0D73BC1B558385ED88E77522CFC296E42C29B3081F70D1A757A5E1EA660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963179, "uuid": "648f0cee-15a3-4672-a881-0723ecf11b61", "value": "12288:++32xSsLHMSCiAaLflE/MQUW4ptNy0xnK1zKaKlCFsOv6eLyNA2s4:+NxSsIFiLLflEBputK1zKRlKpiCyCj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963179, "uuid": "a7437a0a-8f05-4a52-b492-c73ae2dc9300", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963179, "uuid": "fb748451-488a-423f-85e6-f6ae33a8bae8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963179, "uuid": "4569d3d2-79a5-45b2-8cf1-4a14e2532cec", "value": "TaiwanTrade_PO007707122026_Product_List_Specifications_RFQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e98f5a-7ee2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783964810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964810, "uuid": "4663d7d9-6991-4f6e-bb92-db16f354c747", "comment": "Malware payload (Mirai)", "value": "df5260e3bd31fc01144e7674b738294e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964810, "uuid": "05c749fc-cbca-4095-ad2d-18e658bcd04f", "comment": "Malware payload (Mirai)", "value": "4f70c1cec3c4453c7d78a48cf688d1f22813d4b90ef4d86a75979afc1345387b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964810, "uuid": "cb017620-1c29-42fc-8b01-6620b14ea6af", "comment": "Malware payload (Mirai)", "value": "40f30c40630d2a27aa870de47ab75869e96a1dcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964810, "uuid": "49cfa103-ebfe-4921-9b29-7e0b0f480ab3", "comment": "Malware payload (Mirai)", "value": "b818b149a580c1735103886720e68510e230b6af10d1392e1c527ab3c0bf74b78bb811431ae953b9af7fe18c64d9a51a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964810, "uuid": "a37a15c5-32b6-4531-ada0-f90629fec81c", "value": "T18FC3128EAFD73888EF371FB68847F39223149117A5074FD4159EC211AAB1228B39F166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964810, "uuid": "5e5cdeb6-7549-413f-a515-b48d54c8e879", "value": "3072:OP7n7wtZXgpUoMd7YAsdHfP86r58HidtH6qsO:OD7EXGUoMdkd8KMsQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783964810, "uuid": "279ead8c-ded3-4634-9285-969fdb380a66", "value": 123004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783964810, "uuid": "8621f0a0-2775-45a5-adda-e1be79c040ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964810, "uuid": "cece78e9-3a7f-43ab-a622-8e34262a8a90", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e663a71-7eed-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783969203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969203, "uuid": "da691416-bc82-42a2-b6e9-242f1bc10d1e", "comment": "Malware payload (ConnectWise)", "value": "eb864ece91436663c54d926996958e12", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969203, "uuid": "382b7acf-a763-41d7-947b-5d29e846209d", "comment": "Malware payload (ConnectWise)", "value": "5238b57ce76064b977a6d5800f00f4120d795381f12fab93c7491997de6cfe67", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969203, "uuid": "eb09a5d3-dd7c-4481-9dbc-da387f856a04", "comment": "Malware payload (ConnectWise)", "value": "7817bbc1fce9863bb4f9a8214ba5a84423331d3f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969203, "uuid": "320ec34d-5fb7-4504-98d5-3fc44a5bbeae", "comment": "Malware payload (ConnectWise)", "value": "9afc93d345da2df415f0dcfd5dcdec68c4ad790c1b2d7f8e71772b8c8ac3b62ecb9b8b2b22292aab3293d2f03bd13b66", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969203, "uuid": "2967b167-3c16-4581-8b75-5214b155c00a", "value": "T17B935B13B5C28472E573093158E0DAA09A3FF9215E61DEAB3798032E4F642C1BE75E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969203, "uuid": "46c850bb-57dc-421c-9399-ee04cc60e28c", "value": "5f510e22d141c137199e2ff4021a57be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969203, "uuid": "c25e87ca-8c8b-4d6d-82a7-3a846b11adab", "value": "1536:Kg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsT0HMgdYU:LhbNDxZGXfdHrX7rAc6myJkgsT0Hh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783969203, "uuid": "59229e0d-373d-4882-b94a-0281b1c2d972", "value": 93864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783969203, "uuid": "9a4a9a30-1721-4a87-8b4d-935cf574fde1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969203, "uuid": "204ec5fa-b8e2-45f0-aaee-cdd568b7b3df", "value": "screenconnect.clientservice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af28d3c-7e6e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783914732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783914732, "uuid": "1f7b2faa-f70b-45f0-aded-1769f98f034d", "comment": "Malware payload (Efimer)", "value": "3fc0e74e8c3216a4b7dc30d7c65d91ac", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783914732, "uuid": "fd9aaa00-701a-437d-a792-82d698b33822", "comment": "Malware payload (Efimer)", "value": "52a961e6e33da2febb2efad5c66b07ca4b3c322da9e04a39d8e86239d4fd81b8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783914732, "uuid": "797d4cad-c2e3-4316-811d-4e49aeace93c", "comment": "Malware payload (Efimer)", "value": "6d360baf43aa810fe0b24967f48e99397e3b88ca", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783914732, "uuid": "59290361-242d-4fb8-b0be-6b17d6a56b64", "comment": "Malware payload (Efimer)", "value": "987921756c932a0fde226d4c4d61833d8eebef92da8f47506e6a475210d4eeeb4cfec263b23d4e4f31af8e93cf08cbc8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783914732, "uuid": "11c5fa66-0612-44c6-a832-ff16fc42ff50", "value": "T1CFE6330CA7D016EEEAB3107DEED546A3F591B4764F31C5EB979892969E0B0D0CC39B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783914732, "uuid": "f042284c-2d90-4d52-ae29-34c5525db5fe", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783914732, "uuid": "06898034-227f-47a6-825f-831eccb2913b", "value": "393216:kJrS3VmPDTAjfmSXMCHWUjXxcuI3/PGTAI:kw3VkDTAr1XMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783914732, "uuid": "6ab025f2-4954-41da-a713-05ebdecfa65d", "value": 14330275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783914732, "uuid": "84b173ad-b833-4d95-97e8-2750ab1c37c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783914732, "uuid": "3a47d20f-3c0f-4b0d-a0e9-fdbcde0de8a2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0a6422-7ea1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783936670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936670, "uuid": "2f9a6978-e358-48c3-af4a-d225592f2a49", "comment": "Malware payload (RemcosRAT)", "value": "ec9416ccf51a95a73d9cbd6a54394212", "object_relation": "md5", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936670, "uuid": "f6b677e0-d81a-4e0a-93a5-48c4a82d5899", "comment": "Malware payload (RemcosRAT)", "value": "52bd61ba2153572260fc9b8f7eac34b613272c428e715fe6b3505f96e4eacf5d", "object_relation": "sha256", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936670, "uuid": "34d18c4e-e047-45f7-a33b-8aced34dc6f9", "comment": "Malware payload (RemcosRAT)", "value": "f70b70582d3935ae4b225e7899f8e19c7983f0b7", "object_relation": "sha1", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936670, "uuid": "cae33cff-323f-413e-a7f9-07b032852518", "comment": "Malware payload (RemcosRAT)", "value": "2ca22984d4879cb4075bb90292f3f0cac492cbf12eb4760b30fe030855263a94dabdfba22e2e844f078943a2f78a2803", "object_relation": "sha3-384", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936670, "uuid": "c7da6a63-aca6-4405-bea5-bbb2bf91df1e", "value": "T1C575CF19E38D12E8D227D134CBA65232E7B5B81A0761BDEF165AC3192FB79D01F3A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936670, "uuid": "968173ea-3526-4f1f-a904-502cd23077b4", "value": "d7a140ad86093e229082e6f8b7493b94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936670, "uuid": "0470ed16-575c-46fa-a3ac-8de736e25fc7", "value": "24576:i6K1AZg7pP732P0pgBUHZyOS2fWTkpnCW7in2JqDN0jdb00Iq8RPulQ:i6K1K+gBUcOSrSCEqDN0lnYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783936670, "uuid": "478f8903-f2fc-469e-a956-dca97228d50f", "value": 1559552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783936670, "uuid": "1c0183df-2e2e-48ae-9dbb-039f5cb0d91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936670, "uuid": "f4a6b0f8-de83-469e-b1d5-1bf0344dc139", "value": "Bonifico n.1101252230290346.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ba0766-7efe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783976898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976898, "uuid": "b24ee3d1-76ab-431b-9918-c59bf0fac73d", "comment": "Malware payload (Vidar)", "value": "2615ab4cea60edc85df76ee114f7da8f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976898, "uuid": "3079798c-cbf6-4d30-9c5f-a995b118d4c2", "comment": "Malware payload (Vidar)", "value": "52ebf27411484098f4643ea8d0d4ca154d66e78de8121d0809ccb437d9f8eeed", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976898, "uuid": "e1adc340-e261-4614-acb3-9eb2fd6d587b", "comment": "Malware payload (Vidar)", "value": "17018a9310d84a740b36be20ed01d309b4db919f", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976898, "uuid": "e903ea6f-8e56-45de-a2f7-834fb1f31afe", "comment": "Malware payload (Vidar)", "value": "b21517c558ca4bfd2a3aa1a0d982475775c6403326f32f369e56a6e9dd5eddd8fb5bca131ab4bad8bd0fef298993c459", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976898, "uuid": "98a16524-c629-429f-99bd-4af73d6c913b", "value": "T192E5AE077CE148E9D4AA627289B650917B35BC180F3A23D72F50B3782FB27C19D3AB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976898, "uuid": "e046f773-e811-4985-b779-106397d870ba", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976898, "uuid": "9c49fa0d-0245-44ec-823d-152e1c734a90", "value": "49152:Vv8ejMjobvYHEnxXr4hurBxogIMJeIScnL/XWyi+oKKcwIW:VvZ5X4urBx5lBScnL/XWTNcwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783976898, "uuid": "669def9f-5074-43dc-9904-c0b4e31b0a03", "value": 3094960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783976898, "uuid": "94996be0-f4db-44ce-8904-7f42496c91eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976898, "uuid": "14564deb-ebd6-4fce-b276-b67e64aa3df9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef3adb0-7e81-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783923007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783923007, "uuid": "b38f1b43-8727-436e-a4c4-eff93b8ede5e", "comment": "Malware payload", "value": "b8a45eda305456a2ffe44e29369975e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783923007, "uuid": "334f3349-36a7-453b-a46e-deaf62fbff5c", "comment": "Malware payload", "value": "52f39d0c0d008faf84dbd944cd37d20db616ffe1b2202222129d94951074625a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783923007, "uuid": "4c451a29-e8ac-4759-a1ed-e7d1af2c4448", "comment": "Malware payload", "value": "ee64199da59495d87afb27d166f801592548becc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783923007, "uuid": "b36c0ee7-b698-44f4-a8ce-d922a3e005fb", "comment": "Malware payload", "value": "b84691ed6ac870b66d8fef9e6788e364a76c433343b6c97deb79e3302f8bd8f6cc52971f90bdc2c04ce78fd964fbf545", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783923007, "uuid": "907906fe-6a4d-4c10-ad6a-63d07df0f067", "value": "T15D21ACB2F1F569753F748499A106D13036DA3B429BCC6CE289BC9EE23623559E090F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783923007, "uuid": "76b59458-2614-4408-98f2-f597da806a4a", "value": "24:w1NLde/C7Ur+SrNvNSL5lOKvH0TGz5lOKvH0TGP:wTZhU6SuOKvH0TGGKvH0TGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783923007, "uuid": "ce627ae5-ff4a-48c2-8495-988e21f79aff", "value": 1185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783923007, "uuid": "1943790d-1975-4192-a58b-2be924bbe0b6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783923007, "uuid": "45b6a214-5132-4887-9010-f7d3083df0ca", "value": "rev.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410bdb8e-7ede-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783962846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962846, "uuid": "4dfb72a7-1ffa-42af-bd4d-1e7dc24aeb63", "comment": "Malware payload (RemcosRAT)", "value": "03c4f2ac25272be107adcc0dcc1ef8ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962846, "uuid": "0ea1c528-16db-4150-9b4a-46164b37f2c3", "comment": "Malware payload (RemcosRAT)", "value": "532af7026091f1b8eea917ef49903baaa68aca440b334cee8ac22ec7c56aae62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962846, "uuid": "a11c5285-c201-40a1-a3cc-f2060b893a22", "comment": "Malware payload (RemcosRAT)", "value": "8e15d9199f093f1cd945b8f78bc5d6193879fd11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962846, "uuid": "f0205d40-738f-4df9-971d-c06118413252", "comment": "Malware payload (RemcosRAT)", "value": "f839c8990bb05f598a0fe4f207d8ea0ff37dc19b2479de60283984d733668e40767bdfc1e0c59cb4da5e58f5bd1061ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962846, "uuid": "ce3ae792-556c-4b71-9251-7246d257029f", "value": "T101B40241FFE698E8D876C13597FAE1A31431BE9C0968621F56247E7FBD70A90C93A301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962846, "uuid": "6ceef02b-0a99-4e2e-9114-f364ecc9761d", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962846, "uuid": "aa0eb9a6-3ebb-4712-abc6-b11885aef51c", "value": "12288:qBQEiDvu2SfA+nMR+9IbtT2bNWEa+ZPQYc2jSkfrcy:qBeD9S9n99CJbEa+ncGQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783962846, "uuid": "75e1a9f6-799f-45c0-b2cc-5728077682a6", "value": 509776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783962846, "uuid": "b447e098-687e-4502-927b-f966b8f3ef73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962846, "uuid": "86b0abab-df83-41fb-89cc-3a0a6cebfad0", "value": "03c4f2ac25272be107adcc0dcc1ef8ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dbbcce-7ee0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783963634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963634, "uuid": "07dbf344-ee9f-4abf-9b27-f637e931704f", "comment": "Malware payload (Mirai)", "value": "e662a77371a01bfed5d43a2ae7df612d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963634, "uuid": "a321f986-4e7b-46b4-a8ec-a89e8961238e", "comment": "Malware payload (Mirai)", "value": "5353e8ca4ada5c7b6fdfbf5393c18a7138f9c8a689cf2fed7c1b12babc649c52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963634, "uuid": "90d2a2c5-96cf-4be1-a25e-3e11bcf594e9", "comment": "Malware payload (Mirai)", "value": "da2223940caa61c9d20552d55ea835a56d4e8f93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963634, "uuid": "9837957c-2539-465c-8166-7c7e9456c4b4", "comment": "Malware payload (Mirai)", "value": "1bcf438ce237a815b93ea6ab7f1696e41dfb35dd8ddfd2614c3f53c8d182f7729a0c5cc3c2a20b05ff3d49037b3d6dde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963634, "uuid": "1c852808-d627-4a64-bcf1-90b7627d9319", "value": "T13D63B74A6E319FEEF268C73047B74A31E76867D623E1D685E2ACC1041F7024D585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963634, "uuid": "54d4e4aa-d79d-4bd1-97cb-6b6deb36c7d4", "value": "768:k0NVGiWf6mj/s/VM1pQzVXtKcYGIDGsi3yAk+AexCVhXoqZpOGwtZ3RBIxi:k0rGTpjkWWVXtjYbvVexCV3p7wtZ3RBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963634, "uuid": "cdf83955-caf3-44c6-8125-4352200d4e2a", "value": 68428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963634, "uuid": "eae5d31d-e400-4ae2-b1e3-c7d8c3125634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963634, "uuid": "4ad0dd46-377d-46ad-aa1e-df90983ff5bd", "value": "SecuriteInfo.com.ELF.Mirai-DJO.23614546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2708d92d-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963232, "uuid": "870936a4-df10-4182-ae38-2cb552b61731", "comment": "Malware payload (RemcosRAT)", "value": "09a91d6a6e775d347b78f690eb1ea7b6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963232, "uuid": "e18c9479-1629-4a7f-9a58-3fd90adc664f", "comment": "Malware payload (RemcosRAT)", "value": "53924f885f3bd944679b215e80a74037186f414297aee3029600b398b8d924dc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963232, "uuid": "324c3a91-5b7f-4123-9ecb-9934f4749da4", "comment": "Malware payload (RemcosRAT)", "value": "b0a837e31f74d3dc373c9f6b0827cbbca24a0f0c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963232, "uuid": "ea33b1c1-aa69-404f-9d1c-b73a3ed504de", "comment": "Malware payload (RemcosRAT)", "value": "f298028161b3e6353b28b77bd9a379b0f2f71b22180743ef591e90f9f7508dbf9d1c63c2aae97da69b0b2bdc7534ca22", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963232, "uuid": "2914d0de-54d3-4906-b21b-d8f1e24b266a", "value": "T1B3F42329B7D8DF23C16B94311ED8827E88892D747F14A3A37185B74E1D307FA4958EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963232, "uuid": "d7b1338b-7726-45db-a94c-54af3f8fda11", "value": "12288:8+323/Uz2OXuZfoeh/2fMDLHn2kQWOlB0fuYQdGtbhJMOMzxniDKgQKO:8N3/Uz2mCfoeRBDr2kFYB0WYQottJMOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963232, "uuid": "8ef14242-4c97-4e4f-a006-803d05cb2586", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963232, "uuid": "2be44b11-3afa-4b4b-be23-7d6f43e04b14", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963232, "uuid": "cbb91d9b-5926-4387-a44e-a9fb2d5ccec7", "value": "RFQ-J&P202607.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e10935-7ec0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783950053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950053, "uuid": "b4d327ee-316e-40ac-a724-fa4f4797c111", "comment": "Malware payload", "value": "0b269a24c2ca2d26094269dac69617f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950053, "uuid": "c3652d97-6694-495e-9046-4ed71227dfef", "comment": "Malware payload", "value": "53ea8c1cb4f4f461628f3383a80fe60957281342c1d713064f2f26d2542aa1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950053, "uuid": "1e1e1389-790d-4abe-8cf8-dc477d54f49c", "comment": "Malware payload", "value": "80d2d4675086087ad1a4811fd98ac6c190f0dfe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950053, "uuid": "20c68d83-68f2-4258-ae24-65f60d8541aa", "comment": "Malware payload", "value": "e54195bb59ac6c7606a2e29a89b097a1f619082cd1310af2858355560afa54a9bdcfc5f5b2d18e658aa7c966c0d60b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950053, "uuid": "2ac6f7bb-d157-4937-8e64-88a8bb0f9835", "value": "T10F42D90C9215B087DEC59BC97C7B0A7ED4FD887CDD72EDA89397906E29D2108982C63D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950053, "uuid": "0f47dff2-1c81-4650-9bf1-ac43700e0efe", "value": "384:dqT3kv+wHw7XbyHy4gvQnYUFCkqgEWHc79XP9kxtnq6Af7:c3kv+wHw7L4yPvQnYUFCkqgEW2XeAf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783950053, "uuid": "94b0835f-d30b-490b-958e-6c84c8fb43aa", "value": 12989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783950053, "uuid": "793d27a5-389f-400c-9136-3873187a0c50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950053, "uuid": "50e2adbe-aa54-47ff-8d33-744e23bb4b4f", "value": "12.2. ANEXO A - ICA\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc2debb-7e80-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1783922763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922763, "uuid": "b2e10ac2-7281-4487-92b1-a55bc37db288", "comment": "Malware payload (DarkTortilla)", "value": "a3d3d4bf23539d99f124c2afc6484ad6", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922763, "uuid": "53b55265-6c05-449d-9674-cb46379c714a", "comment": "Malware payload (DarkTortilla)", "value": "54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922763, "uuid": "bfca5228-af81-430b-847e-1a7c16af124d", "comment": "Malware payload (DarkTortilla)", "value": "9cc8f27638469624545219535b75351e93cbec2c", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922763, "uuid": "1bf097a0-3934-46a9-aa0f-fd6e97b0e550", "comment": "Malware payload (DarkTortilla)", "value": "7db585b882dba150e3906d13468d59e14cb635931c2698dc5fa0b923b0a4c9913613b0afdac319db5f4a7157a4ac3cd6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922763, "uuid": "5193c7c7-db7d-40c3-8611-0e8dea0a8c4b", "value": "T16D35F0259DCB5A14CB3D4A78C1A6189823F0D613C32BE76F3EF9A1F48F96B856D17042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922763, "uuid": "f9d8626c-d3c4-4f27-9891-4a55aba1133f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922763, "uuid": "c91b7ee3-3187-4975-8a50-25264bc20657", "value": "24576:hNwUS2UxAPqGcv/+Duyx46QoDPHD/Sfn:hN7+qPRcvEFQoDP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783922763, "uuid": "437ad289-2e46-435d-8285-eef37f12d2d5", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783922763, "uuid": "dc1a63ab-2ff1-4e01-9383-614179dea23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922763, "uuid": "8b1d1276-5ea4-4055-a973-b6ed75e8b79b", "value": "Dolphin 06_Q88 V6 (Oil and Chemical)_02Jul2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547a8daa-7efe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783976622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976622, "uuid": "f1ae0be4-0047-4982-9da0-66d3d0f0f8dc", "comment": "Malware payload (Vidar)", "value": "caeabf7b665b7c9e38ca0dc7788c9a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976622, "uuid": "54fbde7d-09fe-42f5-bf70-5ff6b3db1857", "comment": "Malware payload (Vidar)", "value": "5536939f5e284524a0ee5f1fe401ac92237e4fb013b8c5adfc5b84d3b6d95017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976622, "uuid": "e4039846-3e44-4793-8139-2ff423728809", "comment": "Malware payload (Vidar)", "value": "35d8ee05bace89a278cfd9f7eb6ce625b27c002f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976622, "uuid": "ec94e657-ec71-47fe-9c05-46a3e3e3d313", "comment": "Malware payload (Vidar)", "value": "25acf459fd8d402333e3585937744ade346583559e9fb5886a81aef0a9ec50ba763da0644481bf65f4cf56886cb6441e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976622, "uuid": "c1335521-b766-4f45-bff3-285fce7c0e09", "value": "T107E59D077CE248E9D49E633289B251927B35BC190F3A23D72E50BA783E36BD09D35B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976622, "uuid": "e1c5203e-fb9f-4fde-92db-d74f4efe484e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976622, "uuid": "2ac8469c-5786-46c7-82e4-14d0a2a9dc86", "value": "49152:JR5W2I0EUxlVC+TatRp96qDL4IkhaAKijNTWNkamSyGmG9fI/G:JRr/TG5iCiZTWNkT9GmGlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783976622, "uuid": "a0cf26cc-e634-4bc2-823c-b6f1640153a2", "value": 3097520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783976622, "uuid": "bc5824c9-b878-4e68-80bb-73db409175a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976622, "uuid": "ebe24c72-1a5b-441f-aab2-b7314f00dfcb", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6320bd02-7ee3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783965051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965051, "uuid": "83e3f7d4-f446-46a9-bc07-8504cccf8b94", "comment": "Malware payload (Mirai)", "value": "42dce969626e7797c785648ef1f23478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965051, "uuid": "8e62efd0-2d12-4df2-9cef-eb268bec329e", "comment": "Malware payload (Mirai)", "value": "5821480d830bb3d696560af6dcd83d16aa1dc04825052d4e0e137c5cb8a158db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965051, "uuid": "f55b1a0a-e9cb-4042-a9a3-5d96ae2886ad", "comment": "Malware payload (Mirai)", "value": "42fcce29ec98a325901834bbcf0b257aeda43962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965051, "uuid": "8c010a08-b07d-4087-8ae3-cfad919baa0d", "comment": "Malware payload (Mirai)", "value": "1e585747e54c131b2c619746f9b8a77af8bf2a8545afadfbd13f6658c430e4cf689c0309fbbb5baed837aca1f73afacc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965051, "uuid": "9cefd1a5-33a1-437d-bcd1-2f2b9ae6394b", "value": "T175D38E5C9D1E7DC2C2C3F2FE6D450F66312675744A68C3F6190062CEEB9EED698B1421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965051, "uuid": "3bea5bcf-bfdc-4d1a-8a72-1c387a04ac93", "value": "3072:q8FvTnMv6y7VDwwGBelXwzm0aVM2RNPXmhdCKhR2Jjq:ZVwC+B7Xwq0a5RRmh4K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965051, "uuid": "78d7d84b-c8a7-4e8f-9d5e-ad74154fc9da", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965051, "uuid": "bf0f0cbc-e595-4f62-a759-ca8595c91cab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965051, "uuid": "82976d73-303f-4b9f-b174-2e6e704a0013", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28a3116-7ea2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783937347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937347, "uuid": "74d2aca2-873a-4fd7-9d1a-b01987b9f5e4", "comment": "Malware payload", "value": "147f2ae49c1276ec1e38f05222389ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937347, "uuid": "1c0dc9f8-f0dc-4f54-b359-2c9e066f598c", "comment": "Malware payload", "value": "58c62394cca5b250877ce6ec31a31b64cd003f2847b8d01f5b33e1d5c8aaefdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937347, "uuid": "65540c91-b93b-460f-bc0e-fc546e3898a9", "comment": "Malware payload", "value": "2a526bf824dca3c2f5fb6e2b8d24ad826343e8cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937347, "uuid": "cb5cbe90-4e01-4df4-9fc6-7361dfd7825c", "comment": "Malware payload", "value": "08eeb4ee877e9fbedc32920adeca550249d06b8d0d00ff1b4672d9b609630aaf4e1275a6f9e1d5b4a50a59841debf49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937347, "uuid": "890abb0c-032d-4da9-b496-13822745fd55", "value": "T1A1A6E15EA27623E4C07AC0389123751BF9B1345D877897E7B7DA5B8227A27E0E93D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937347, "uuid": "558423de-df3d-4922-b629-60a68396af85", "value": "21eb3ad077df572a5c104e91762c5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937347, "uuid": "939d87fa-e11b-41dc-b96a-0aaa58361566", "value": "98304:m8Luchxt1NZSWwpSVdvkUtjSEzNDxxg1bzyhDx3rGHYlnkVAih6UC:BSc39ZLwsvkWzTxuyxxbG4lnkVcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783937347, "uuid": "ca58db1f-5c41-4c06-ae9a-5302dc5b83c0", "value": 9523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783937347, "uuid": "c2c6a75f-66dc-404b-a73a-73325433c180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937347, "uuid": "352dbe4e-7405-4311-bea9-8397b226d7ae", "value": "147f2ae49c1276ec1e38f05222389ee8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9707bb-7eb4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783944716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944716, "uuid": "d392fd19-2842-4111-ae62-0e158bc9e3cf", "comment": "Malware payload", "value": "07edcd17c0a6a9559dfd2de482466cd2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944716, "uuid": "3b122cf9-7c57-4dad-880f-8352abe83a3a", "comment": "Malware payload", "value": "5a417de37f8db661c5b77362fc4e46e5761145c6bdd6abff7e6c81d3f4ef8b7a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944716, "uuid": "6d895bd5-5a59-493d-8cda-b21979a7bd0b", "comment": "Malware payload", "value": "24dcb44701a1be75b36c1a60f4f94221af8ce0aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944716, "uuid": "72bfd8e2-df42-4ebf-b6b0-e25d8bdfdc94", "comment": "Malware payload", "value": "6129072ea5905d08f7fdd9adfd394c6f27b0482595f2b84cbd1b28f0abf38caaf93e45bde4927826d5f50b91a2f47333", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944716, "uuid": "c840866f-0cc2-4c3d-a3c6-d016037ad454", "value": "T1EBC27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944716, "uuid": "513cd940-9f04-486d-9f07-4832ddd0c291", "value": "768:288vCB+25j6es8RA9FYpMSUpi+20qUpi+20YQX:288l25JGd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783944716, "uuid": "8e6cc8b7-cf13-4611-a764-02fe76d9bcf6", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783944716, "uuid": "76e99754-962a-4f5c-9021-9ae7f9a9c4ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944716, "uuid": "5d48ce55-dd3d-48e8-a123-1d2684f22206", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a88193-7e55-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783904065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904065, "uuid": "8b3e2efb-d135-4cb7-9442-58870cef72ea", "comment": "Malware payload", "value": "3f78bb45edde3de709fdb0da1e44ea9e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "zecoorigelabs-shop", "colour": "#3472ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904065, "uuid": "fa70e03d-fa5e-4f1b-855d-6219712169f4", "comment": "Malware payload", "value": "5fbe14b476d7bfc8764082e470187109c4f99522606e199a6303346b7762fdde", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "zecoorigelabs-shop", "colour": "#3472ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904065, "uuid": "95efe597-e5d4-48a8-8fbe-ed98c094554c", "comment": "Malware payload", "value": "e182ec877718ed306d7d628a9e953c8e8a98a1e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "zecoorigelabs-shop", "colour": "#3472ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904065, "uuid": "52fa891c-47e9-4f52-b04a-92488a133fa7", "comment": "Malware payload", "value": "be1df78e54c587d240b7da89c3e724d926431e1664061c4d04be9556e3067183625acd99aa6595cd98bec542b090e153", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "zecoorigelabs-shop", "colour": "#3472ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904065, "uuid": "e51a9768-9869-4ca0-aef3-81859b78aafc", "value": "T102A6317B07C087BAF3D847C4446A342E22F9F156B9A43559BB3369EFBC1A9974038607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904065, "uuid": "93c29d9b-1b8b-454b-b20c-75f479c5b980", "value": "6144:ERLX75Ozcl6BTMjhJBhxPh8/GTyndxPSyQznInVECV35wgsQ7zDXJ5slCqjgxoZ:EB5OzeHP4IQ7zSjgKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904065, "uuid": "4fbee8c3-16fa-464e-9d97-35ae8c85ab14", "value": 10272238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904065, "uuid": "36517f3a-da89-44b6-add5-89b74fd98946", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904065, "uuid": "2e992c96-07be-49df-b086-0966371816a9", "value": "payload_decrypted.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5606b7fe-7ef4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783972330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972330, "uuid": "b994b9e9-b3b7-43d8-bc05-3e91e4f7c908", "comment": "Malware payload (Efimer)", "value": "3300bfc707c48bfeb577a5afa19a4f5a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972330, "uuid": "b94b32d2-06ae-4506-b5df-43a27a32ef7b", "comment": "Malware payload (Efimer)", "value": "627a15798107d91a19c04b691c85f8aa09f131d155e98c1a681edd21e9bea0f8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972330, "uuid": "eb386074-a084-40ff-bb8e-6b26ad89d85c", "comment": "Malware payload (Efimer)", "value": "a0e35fa95e6e84e9f731542787a2f29694ae5531", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972330, "uuid": "22765309-8904-4fde-81e0-613d8687af55", "comment": "Malware payload (Efimer)", "value": "773f622ec1893f49dcb3ac050e274d753fa2ce38aa30d2920ef490f35e854513300a7ae03204b544585803be77924ebc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972330, "uuid": "22522d25-5c49-42e9-854b-6697590a8d1c", "value": "T198E6332469D016FEE963413CEC636962E5E5B8B60F32C9DB671483663E170E06DBD323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972330, "uuid": "f9252a2a-5552-486b-a47e-2a21bac2b790", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972330, "uuid": "bfe66b35-d8c5-431d-9059-33fd966c0978", "value": "393216:yi4pl6J+YmMrQ5HOwbV7o0/K81wOUUXMCHWUjXUcuI3/PGTAI:yL6TmMk5HOAVM98FfXMb8XBH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783972330, "uuid": "7aba896e-163d-49a2-953d-9827b59f899e", "value": 14260272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783972330, "uuid": "3ca085f1-475e-4990-9e0d-057f1ae6ac23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972330, "uuid": "84c6e9db-b227-46e6-8be6-e13907f57415", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa671ed6-7e53-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783903457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903457, "uuid": "a821a8f7-7b58-4855-80c2-e81feef8cfaf", "comment": "Malware payload", "value": "e5674cb6d8a7d0955038237edafd8767", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903457, "uuid": "fb950bd7-6074-4d5b-ba9e-efe7db951793", "comment": "Malware payload", "value": "62bf6f399d872c70f58bd10e66c362c669bd92171c9bc5a2e02d4e4ba86b3ecb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903457, "uuid": "274d5845-d1d3-4213-88bf-fb16ef5b3e65", "comment": "Malware payload", "value": "4c1c8df8e43554f5aed9cedc0ef1233af43820c8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783903457, "uuid": "61f9a8b6-32ce-4329-94f6-8d92f1ee4a54", "comment": "Malware payload", "value": "b2cbefd7eb5dd3359200f523f0a6139ebb9ae62d44bf63c9008c167229748751075faafa3e687be6e7e6b1f8cdd5ca6d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903457, "uuid": "19833f1a-f650-4e25-9e13-95fc41d1b047", "value": "T17431FE8D4A30D6CD5E838A4C7A7096C4D95E5782FCD2CB0DB9D5095B207C27836AFF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903457, "uuid": "8dff4d29-d4d7-4bdb-8988-d74b2c4377f7", "value": "48:kUOYiYiwUKa9amyW4mW4toNUypcpjQkU8fnY8ff+ffN3+D+LEoDZuAKqP:zOYiYiw7a9aZW5WRUySE8fnY8ff+ffN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783903457, "uuid": "06c90ae0-8651-498d-84a1-ef50f1b23b7a", "value": 1665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783903457, "uuid": "7801c184-4db3-4394-9f32-de33a471413d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783903457, "uuid": "d910462c-a606-44d9-bd27-0c78a23853b4", "value": "callaputa.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bce098-7eb9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783947130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947130, "uuid": "5f1c593b-9c7c-41f1-93c6-fcf43c1f9886", "comment": "Malware payload (Efimer)", "value": "b1fa9db8d01240bf70550768a66b4e5b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947130, "uuid": "3f403f0c-2b08-40d5-b49e-4f8074a7388f", "comment": "Malware payload (Efimer)", "value": "6336530458fcfd312eca97cf85fb0d701b44514824a90e0da4c8107e768301e2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947130, "uuid": "ee4bf70d-5975-44f9-b1c8-b6b2daa36cc5", "comment": "Malware payload (Efimer)", "value": "92a66775c2c210b5d664b45bba13551745b71d97", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947130, "uuid": "d0fcf071-8c4c-4941-9ab5-6110c97f8431", "comment": "Malware payload (Efimer)", "value": "93d974ee4f78a21f4531f82972e5988bae5dbebb657601b0e47db29904140635d00f7d087cc47c439ed2947337cb9d43", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947130, "uuid": "dda14e77-b51c-442f-b502-e5331b5494ba", "value": "T149E63358DDD062EEE273413CEAD24893F2E938771F36C99B4B5816A2AE631D1C93C117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947130, "uuid": "7001f025-7452-433f-aa04-49727309bcbe", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947130, "uuid": "f03c060c-c8af-446c-a93a-7c3e6aba907a", "value": "393216:ckkNMvTACZHbeOalxVZXMCHWUjXzcuI3/PGTAI:ctNMvEsHbenlxVZXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783947130, "uuid": "84b33843-21d6-4bbe-866c-772fb1ea737e", "value": 14314822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783947130, "uuid": "ecc3239f-6107-4f90-93c2-64cd8b86460b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947130, "uuid": "1081076e-27f6-4507-837b-a952fbe05e20", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374af593-7e96-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783931906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931906, "uuid": "34a704cd-3219-4979-b48c-38a4b7a9db95", "comment": "Malware payload (SalatStealer)", "value": "66a00a43bf3626d775015cec5bb11d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931906, "uuid": "179c09d3-dff4-45ce-9647-b5444ce2aa5a", "comment": "Malware payload (SalatStealer)", "value": "63423364abc33ebeda68838dd5605d60b883e21f3c29b1d98c927c75c8fb25d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931906, "uuid": "7a1f54d1-c8f4-4879-90b2-de9ac713b46d", "comment": "Malware payload (SalatStealer)", "value": "3cdd0d915cb1e61ab3d3145107fa4f3ed2800402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931906, "uuid": "53befbbb-9729-4320-ab02-72a92d37c1f8", "comment": "Malware payload (SalatStealer)", "value": "a2b44148045f20885fe8eb816b88a564880958d8cdd213f1f6acf81a21056b3148d5dfa19f3965e77fe3719892a75e95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931906, "uuid": "afd9a7af-75bc-4c39-a682-03c6373c03b7", "value": "T1EFF533BEB06588CAEB1B4BF419CED3274C8AA07FDA0529CDD1E20A15D1AF535814DE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931906, "uuid": "724e660c-e53f-48cb-b0af-965fc6a04e1e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931906, "uuid": "edba44fe-91e1-40e5-800a-892a26b274f3", "value": "49152:gi5oruToPFzSISKPwxyK6h9rgm30rj9BLYaN+mF9//N8tQBQWrt6XQJ/BKEWTpyW:pKlNAK7K6LD0f9RYcDo7qv/Bj5Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783931906, "uuid": "dc3019ed-cf25-4e37-a009-159a91bd4c3a", "value": 3587072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783931906, "uuid": "bc8d184f-cda5-4fae-a38c-724762b43f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931906, "uuid": "51c22a1e-7bd2-429e-bb30-2c487e31915f", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.4108.32194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c247d5a-7edc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783962006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962006, "uuid": "4d03ef52-c13f-4ba1-b4e9-c68852a4c989", "comment": "Malware payload (njrat)", "value": "5fccc07c12af182f35e909d9571fefce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962006, "uuid": "e718a540-a57a-4b5a-b0a7-09dd248c6463", "comment": "Malware payload (njrat)", "value": "64da4c1638c0e1a6435e2026155f9092e7532235e1a38a8b1c8b9fc85c469f9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962006, "uuid": "517a3921-5cfa-4fcf-b2d7-d5fa7d552543", "comment": "Malware payload (njrat)", "value": "7b46f09f9dfb6363e21e9cc0b7a9797288398f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962006, "uuid": "a3039c91-9dd6-4ef4-9b9d-3bd43553dcc1", "comment": "Malware payload (njrat)", "value": "8f77de8d81b40e99ed801e4f3caba6065b0eec97767d098ca480c3551924c3fadc2593a10636b1d5391811a6bd2487d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962006, "uuid": "2df3d52e-ca7c-4505-8e53-8900747b24ea", "value": "T11C2512003614D62AC985677C1DB0E3BA53F86DEEF900E7865FE8ACEF793AF014914562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962006, "uuid": "26aecef6-f6f8-4d45-868a-1f7cebfb6485", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962006, "uuid": "03d5d2f3-2f5a-416c-8e07-c86e77493049", "value": "12288:5ysZU5Urys0s6ps+jg3Gs9+SXfYmtKdd38VlrSqb8zG/v30UP11+S4NALMc4/RWr:5yV/dszGsqSVFyK33WL4a/RtfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783962006, "uuid": "6bbedd29-c9c7-44e1-b654-2094a51b0523", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783962006, "uuid": "280b5a22-5d98-4cc9-81ac-b5e609bd4919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962006, "uuid": "ab8a1189-b3df-4b76-bb08-7904c7ae7fd8", "value": "rpayment_00267514376.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50eea39d-7ebd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783948699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948699, "uuid": "0fd68efd-11cc-4073-9c25-d1375da8e753", "comment": "Malware payload (ValleyRAT)", "value": "cb0c6801af564392ff22f3865cd31759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948699, "uuid": "6936dfcc-6caa-4bfa-9145-d7d904fa5386", "comment": "Malware payload (ValleyRAT)", "value": "6546aad603716ebbe02412440e8d8d8e5fd7af80f212c6fe45e50a76f093c6d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948699, "uuid": "5b9dc294-5a0a-499a-9b93-3f75466306f3", "comment": "Malware payload (ValleyRAT)", "value": "0607eb8418f7f08970c5c7439dfcf2fab2d82ace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948699, "uuid": "bc9155ab-c613-4d7c-803d-b85466cfdc46", "comment": "Malware payload (ValleyRAT)", "value": "9bf0ecfa1e4152678fdbbb4be4c60b7aec805fadd11fcd8ddb0ef676d5834d19b8f14042ce4d783738fb83d1648300ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948699, "uuid": "62838c04-b963-48b6-a3dd-234ca82f853f", "value": "T1F2F533BFB81569E0E1243E30EB71FAB01F85718BA71C5D30AE55DA7502397C262A7C93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948699, "uuid": "855a879d-ee7a-4db5-b1b8-fd7118703eb5", "value": "be0327808e5248bd6f11ae77f9c1a3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948699, "uuid": "7d263a4f-38c4-4e26-8468-af07a3c36464", "value": "98304:be+v5JO3Uz+bBLPmQvrjdcCzTZskoHaPriUJ7:aC7uFLPmQfTuUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783948699, "uuid": "b8a222e2-439b-4165-9997-1e8f2ca7f7ee", "value": 3321712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783948699, "uuid": "397a8b5e-c1c4-4962-9736-02b7d251e3d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948699, "uuid": "e153b683-01b2-425b-b2eb-86372f1577c1", "value": "2026.07.10\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77f46ca-7ea8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783939932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939932, "uuid": "996b316e-84e3-444d-bbf6-697f474657c9", "comment": "Malware payload (Efimer)", "value": "866428edb5f4c4900085fc9cd5f114f0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939932, "uuid": "d574da0a-0fe6-4aa2-bfe2-9ee8001519d8", "comment": "Malware payload (Efimer)", "value": "655456dd88dbb7f8c7770dc5abd8637a4a5177c8df3edea15f51f49eee1cf325", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939932, "uuid": "dd903afd-b730-41d9-b5e4-80a64731aa21", "comment": "Malware payload (Efimer)", "value": "cb822a77c0b8eac0f1a38aa488db71939c44dd39", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939932, "uuid": "3c3253a8-23c9-4951-b7ff-e95f3a573368", "comment": "Malware payload (Efimer)", "value": "cb09c07bccdf767e34c9ff6e817257ae54264fd85cd97297bec35086dc38df24bfe5970fe9bedf965bce7aab75ae4cb6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939932, "uuid": "0c3e2722-bee5-40f0-9863-9bb9dbdba5fb", "value": "T192E633586AE411EFF263423E9EA142D2DAB6B45B0732CACB1354D7F3BD571C4493CA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939932, "uuid": "d040ff38-1183-44d4-a6bd-c32328be33a3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939932, "uuid": "e414a88a-3f73-4720-af89-470ab149bba1", "value": "393216:ZQhBsXkJoYo88FYMz7MLYj2PBlGLm2Cl9XMCHWUjX6cuI3/PGTAI:ZGHoYZkmzplGC2CDXMb8X3H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783939932, "uuid": "1e70f6bb-5a65-4859-b5b4-af849f0536bf", "value": 14325715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783939932, "uuid": "a6fbe96e-c24b-43e6-95fc-db18bf68650c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939932, "uuid": "3d1e8a44-7a21-4ff3-a40f-d34d6f5f2190", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618be920-7ec4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1783951734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951734, "uuid": "02324a16-a8c8-4823-8cd5-a2f2f811e48b", "comment": "Malware payload (Cobalt Strike)", "value": "3b483dce1793ec320b176f90492e1731", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951734, "uuid": "e12273d9-c847-409d-9dc3-190a087df249", "comment": "Malware payload (Cobalt Strike)", "value": "65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951734, "uuid": "045bee73-cca1-4813-a2f1-619f2aa4fa1c", "comment": "Malware payload (Cobalt Strike)", "value": "c2ca3ffb1274c7c5898e84bac2e52e75d317cbb2", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951734, "uuid": "ed5b84e2-5c49-4497-8459-510b4c71170d", "comment": "Malware payload (Cobalt Strike)", "value": "2e6859b42de4e568d85067381745a069a49b332f6257f97d7ee08a765edef9e9c1321c89d643979a0bef7f50dc3c31c7", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951734, "uuid": "dc91c2ee-d178-4064-a4b2-07bcd84e0474", "value": "T141D5F94369DB0DEAEDD27BB861C35335E774FD318A291F2AA704C63129536C4AE1EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951734, "uuid": "419007a3-3d46-4e33-b19c-807f34122f2f", "value": "ff82b6d127432c753f4c23bd2b2cef8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951734, "uuid": "7c941375-fcac-48d5-b100-09e055f3f997", "value": "24576:Tvf8RTEKbJYZoYS3rFEMOwgPR/r+0OQqQkyn+Y81nAc+Ec0xMkl81sU3Ao1poM7Z:bf8RzbJY7YAPtoQqA8nAbpoM7oq7Hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783951734, "uuid": "30f74f3c-7b62-4bda-b994-a622d4e86cb3", "value": 2947921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783951734, "uuid": "bb02cede-1cfe-4f5e-9f79-2144018908e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951734, "uuid": "30be23a7-faea-44bd-abed-2e564a96721e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f2f827-7ec2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783950907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950907, "uuid": "5b66cf58-64c1-43fd-8986-f9a704aec135", "comment": "Malware payload", "value": "d91f6c679e75c1db223a828999da0ac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950907, "uuid": "3927b1a9-0097-4f2b-9644-de09f70c8d14", "comment": "Malware payload", "value": "65ff7fe618c23625210043b07695c29876df39b4db3347199fa38b2412fed9fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950907, "uuid": "c06bcede-2c17-46f3-bcca-dd2611bf5251", "comment": "Malware payload", "value": "3ff07f9e2f1557cda41e337973cee7979c01bfb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950907, "uuid": "ef074e89-90b7-47da-bdeb-f9b981ecd98b", "comment": "Malware payload", "value": "69a750879a8564e9e925e1efa8e57cb792dbd175bf8ae145b0d4965f18b97264307f4c06b5f2ce0b79a7b79bacb0e375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950907, "uuid": "3ee15b8d-b25b-4235-a82f-bd937af1eede", "value": "T12792E91AB34384DED41BD6B49AFB5B337970FE634A60473D12A0D6B91F20B406B6AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950907, "uuid": "a839764b-e5e0-4f24-898b-54102ffb26a4", "value": "6afe6e7e4d487fc5bcd33874ef649b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950907, "uuid": "49105e4f-877a-4e49-8319-be4473a3bcbd", "value": "384:RG718YggbJjQQTw3LFjggDAI19mq6Tyv+u:RQfbT+HSva+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783950907, "uuid": "027d675c-9bd5-420b-adb6-332c88aa4887", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783950907, "uuid": "a3d387e2-e3e4-4f1b-939c-358e49d7305f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950907, "uuid": "df5dd970-c476-4da0-b65e-ebf0000a63ac", "value": "d91f6c679e75c1db223a828999da0ac5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc8422b-7ead-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783942013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942013, "uuid": "a944c99b-1c17-4782-a4a8-f0911bcf0355", "comment": "Malware payload", "value": "adf51018141817baadbb2d7a3eea37aa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942013, "uuid": "3045db08-3d09-42f1-aa5d-00e0c292e00f", "comment": "Malware payload", "value": "6665321943022743445111d3911c3526031c9005b947b2dcc82b8aa8b5fed721", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942013, "uuid": "0f7734f5-ba4c-4c12-90b2-efda9f6ba361", "comment": "Malware payload", "value": "0c91ffb71c84a59b30691859954fdec0a2db0e8f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942013, "uuid": "9324f076-2f88-42b4-b0e3-72c774ff62fb", "comment": "Malware payload", "value": "7f7bfd6de7be644b95223b7ac27accb650ca8dd02fb999fa3e4b9800d87bd856465d3f76e66cf4071fb9b2d15b917315", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942013, "uuid": "476cd48d-11d5-43f2-a0b3-448799ee348b", "value": "T1A3C27C956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942013, "uuid": "945c076a-b04c-409e-ba2a-ca9b05085193", "value": "768:v8vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:v8l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783942013, "uuid": "1e27b172-6746-455d-81a1-89b3328ba721", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783942013, "uuid": "22e930f0-7b1e-476f-b6d2-f1e023c5f5ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942013, "uuid": "0cc15276-e520-4547-8e8c-02f14e1b1084", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a40633-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963236, "uuid": "fff0d6e2-2c97-4488-b927-349c151dc4ed", "comment": "Malware payload (RemcosRAT)", "value": "66cf54c83a76e8c3491fe4e0abc824e5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963236, "uuid": "0242cd87-9708-4004-9357-c368cf2ba1a0", "comment": "Malware payload (RemcosRAT)", "value": "681def091d48f5ae99867f186a5474474e3e67e49e0ca9360fb7e2aa1b929abc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963236, "uuid": "ea4292f7-3d5a-408d-9d32-7d326e7fe709", "comment": "Malware payload (RemcosRAT)", "value": "17458a7957227f62c16075c6b1fbd2b6e9533d6a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963236, "uuid": "d2c0d40c-2b15-41d8-8538-cf526278cf67", "comment": "Malware payload (RemcosRAT)", "value": "bf285b7795e6fe4d04dd1b4b02db09976342e93672ae98528054223839b6f84ab7275c455c71ff0a8d517c044a0adf4f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963236, "uuid": "14a51c43-15a4-4eb0-9a05-fccc3b128e6f", "value": "T1A4F42313FBF5D95FE32298B004DA52338908BC8267A973973124B34E8B35BE469D1766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963236, "uuid": "5390d8ac-662c-40d1-b916-57acd61a9aed", "value": "12288:U+32X1PbQBMV0AFo16iCTMRHVqoYmrcEW21qVJwF7VpmzBU/vphn+9mpShC:UNX1PbwntCT0rcEW24VJ+VYdUJx+EYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963236, "uuid": "81f5ae4a-cf98-449d-9ebe-6f6d7e3412ee", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963236, "uuid": "7ca748dc-9a69-4bb7-a476-1158c7ce7948", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963236, "uuid": "74d39847-d2df-46ec-8674-2b8fa5577497", "value": "KM_226_05652.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194a4870-7e80-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1783922407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922407, "uuid": "46f87ecd-9754-4554-af65-8eed37e3930f", "comment": "Malware payload (PhantomStealer)", "value": "1f4592236b79ab34050769f725387de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922407, "uuid": "d0fc6f87-880d-4002-b72f-67a36101257d", "comment": "Malware payload (PhantomStealer)", "value": "69346d2b7d476208653f58962bda327b95e7dcf3c033b983071538bfb3f2ced6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922407, "uuid": "e9d75645-63dd-48cb-8ede-322934b8fea9", "comment": "Malware payload (PhantomStealer)", "value": "8162620a28100d4731ab252428c3b898d60ad340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783922407, "uuid": "61d0bddf-b4e8-4abc-a901-44463637b216", "comment": "Malware payload (PhantomStealer)", "value": "485872d32fed28432bf29e482b20f71d25a40c0a52e040de172ffe98947ba96367d61120d0205926a62d26d0ffd56477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922407, "uuid": "496f909b-75bb-4692-bcb5-6f38a1c885c8", "value": "T1105512503254E612D599637809B4F37A23F84DDEB412DB829FECACEF7D32F1249146A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922407, "uuid": "63c0098f-1ff6-49b1-ad2e-008b086d4916", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922407, "uuid": "9c2c7094-c98c-4420-aec7-631a31202273", "value": "24576:CV/Yyx4CIS4i1KYy0OElpwIKQf1GthMC4AuLHpW/nCicWsL/tOM5d1zQ:D24CIS4i7y0L2IKJLQAuA6iPa/oM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783922407, "uuid": "6bec2d92-07cd-4c2d-a869-e0cee42787b5", "value": 1338368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783922407, "uuid": "2626a50f-fa3c-424b-af0b-baeb538ae3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783922407, "uuid": "2887a6cc-0632-464a-8ace-c7f8eea95d66", "value": "rPO738518.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbfee8a-7e4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1783901580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901580, "uuid": "e1d59182-fd0e-46b7-9502-7b696544588b", "comment": "Malware payload (ZigClipper)", "value": "1381a14bc511b5e2141ad7531cefb7c0", "object_relation": "md5", "Tag": [ { "name": "45-115-27-4", "colour": "#A3A751", "exportable": true, "hide_tag": false }, { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901580, "uuid": "02162a65-b906-4aee-a4c0-abff4717f94e", "comment": "Malware payload (ZigClipper)", "value": "6962c8746be0f2b32b158a5f8d59882ed101c725a54014a4a7175af744e3a5f5", "object_relation": "sha256", "Tag": [ { "name": "45-115-27-4", "colour": "#A3A751", "exportable": true, "hide_tag": false }, { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901580, "uuid": "8300166d-4136-46ea-9685-6d0d11e20bf2", "comment": "Malware payload (ZigClipper)", "value": "70faf60d0ee0296ae189d00fe72a223e91ef70b4", "object_relation": "sha1", "Tag": [ { "name": "45-115-27-4", "colour": "#A3A751", "exportable": true, "hide_tag": false }, { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901580, "uuid": "2dc9f19c-afc3-4c8f-9c54-7b78cb168f74", "comment": "Malware payload (ZigClipper)", "value": "5b6b143b4787238eed64fdda4bb70f92785917e7d6b8682b05bca7f417654fc8c8251090f9dca5e0b68a61da2afea5d8", "object_relation": "sha3-384", "Tag": [ { "name": "45-115-27-4", "colour": "#A3A751", "exportable": true, "hide_tag": false }, { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901580, "uuid": "3bc41f9c-7d66-4fba-a35b-79f8e9f85c88", "value": "T12FE4398F452899D1D43972B3C02AFB0EAB39FCA5669591DF1A673321F93C5498C0B237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901580, "uuid": "ca56e191-deb7-44c0-b327-4352389125e9", "value": "12288:8m0uYRrH3YK+Ci3eplBc/rwmn2cQDuGNaArnTxZaVjE5wTWvtXHfjKn5T7cy1iVT:8m0uYRrH3YK+Ci3eplBc/rwm2cQDuGNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783901580, "uuid": "981b3bd5-5b57-4db8-8c93-7cfc61add748", "value": 679488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783901580, "uuid": "425f8458-79c0-44e5-8176-1ccbb4e3fc92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901580, "uuid": "1a0b7d14-7f0c-4384-9ca2-d1dce2b9a850", "value": "dashboard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbe77bb-7e57-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783904882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904882, "uuid": "75113279-3a95-4efd-b271-8e1d5b4b528c", "comment": "Malware payload (ACRStealer)", "value": "a7d5151806056321cd95d5cf92f4bb6b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "auth-predatordeuce-cc", "colour": "#7BE63F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904882, "uuid": "b5d3f558-b6c4-4578-adcb-586c3d89f983", "comment": "Malware payload (ACRStealer)", "value": "69bddeb75e3b47d1e8a26073149c695309a95da1808ff3d6fefd0a1ec7affdd3", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "auth-predatordeuce-cc", "colour": "#7BE63F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904882, "uuid": "99137f87-eff4-4ef5-bc42-a855c5914254", "comment": "Malware payload (ACRStealer)", "value": "8cd973c5089dd74a7cc4a1b7039394b5760b2ebd", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "auth-predatordeuce-cc", "colour": "#7BE63F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904882, "uuid": "31eed7e5-e7a0-45e5-8f85-8c79aff72509", "comment": "Malware payload (ACRStealer)", "value": "626feb9b554e85ded1a3bd2fcdbc956041ddbf58a41d992c8bff0565d280e94bf6c4e97c4d5a6a397f87ae6562e22566", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "auth-predatordeuce-cc", "colour": "#7BE63F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904882, "uuid": "cfd25e1b-f9a3-40c1-ba6a-a9588169cc91", "value": "T138254AAB039C79A0E4B97CBF1C22BE5A4A68BDDBF1D4F1C702D7507261B84C1109966F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904882, "uuid": "5a349a20-b65a-4c33-99b3-82ad1a625c09", "value": "24576:LZyPalaz4BsxXP7KG1+dfbI9il4dAAj7HzRIVx:dya+k5u2D2Abx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904882, "uuid": "ba30ea4b-fd90-4458-9209-82154e9522a3", "value": 1006744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904882, "uuid": "1b771f09-35fb-4cd6-83c3-73a8a1fe97d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904882, "uuid": "4ee8ac52-3d98-458c-9394-f12b555a58b1", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8630a657-7f04-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783979283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783979283, "uuid": "feeaa82d-5128-4b75-b00a-46bff18b1168", "comment": "Malware payload", "value": "22ceb9b054edff91b17be26e0acc0553", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783979283, "uuid": "98a6da32-a39f-463c-a4fe-b4a8b798632f", "comment": "Malware payload", "value": "6a88e77d52212abb66102febdc5a396d4b3e9bb85a093762e646e3e91fe2ce97", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783979283, "uuid": "26b0a721-da94-43a6-9638-7fcb14b53c09", "comment": "Malware payload", "value": "bd1b6701ed597f8db6189b303877dcc14e35f215", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783979283, "uuid": "95c396f5-34f4-4477-afe5-4dc76c43415a", "comment": "Malware payload", "value": "86456d60040ecdeb1066771487d514ef0c62ca254d1019b7f519962d18517680526340eee649f597e08ec24bdc735b1a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783979283, "uuid": "c4283508-ca29-45f9-8d02-715566620a14", "value": "T1ACF1AB6219215E041873933735FEA118FB63285B82401F703D9C47139F3229989833A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783979283, "uuid": "479e5b35-8b85-40fa-9592-40f991247ca4", "value": "12:TkWqk18F5EbifWW0igOHo7qGMCH4AzsqKBPGb:VH8F5EOfWWHbHiXMCH9zAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783979283, "uuid": "bcd3c5de-dc65-46ef-998f-3d0a0cb09d26", "value": 7654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783979283, "uuid": "f4fb1065-72bf-4f61-9767-7118bf996437", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783979283, "uuid": "debe4b59-098b-4afc-a75f-d982b1a6a8e7", "value": "renewcrypterforresults.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1b2683-7eeb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783968473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968473, "uuid": "d69cbfd8-6b30-4956-a961-aae47ae4117a", "comment": "Malware payload", "value": "2ad8c68e6389feb708b852d37da31334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968473, "uuid": "565a7be7-45cd-42c9-af1e-60186fbefc28", "comment": "Malware payload", "value": "6ab43460e36b904dad331bb3b59cb2a341539b63af791013b2163e5bab8b85a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968473, "uuid": "8cf5f4f7-5eb6-4a0c-afea-d833d6438d51", "comment": "Malware payload", "value": "a698dc2b5385cf74ad7e70362e54059c8cdb6fbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968473, "uuid": "3e9d5e84-2f36-4adb-8bf9-66e48ec8acb2", "comment": "Malware payload", "value": "dca8cf016f8deadd163ef926df424a249d85c0a174babbba34ab0d4198325ec62cdd748b7ecb654e63d9768135287384", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968473, "uuid": "70308498-bd90-4c9a-94f8-5c5c4b674db1", "value": "T1D4C3120F8173B07AEA37757852A69F05F3323D234226843FA9F0722DF5B96759620385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968473, "uuid": "f8036836-affe-486a-b5ed-a0628d23cd81", "value": "3072:Y/SrSyKmhOynFNhVzOPWIMjCCLxTKEQtlT:MNahDAziVd8DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783968473, "uuid": "5c8ffff0-64f9-4cd9-8472-848dd5cfc7e5", "value": 119360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783968473, "uuid": "66f1a581-f44c-4801-8b87-146d718b484e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968473, "uuid": "adcd293f-100a-4707-875b-8abf7a32f7ac", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba86f6b-7ee0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963669, "uuid": "6fc89ba7-a2bd-4fc2-a8c0-bdf942ee63b3", "comment": "Malware payload", "value": "0fa6e6ba520a5050dc674001871e7ecb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963669, "uuid": "6f8b755a-317d-472d-b151-0e1443ceeaec", "comment": "Malware payload", "value": "6b07cc6fb49a3286ed3ec4f38ac2e5daebf2e59bfa21673b471ec3fe1e60fe51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963669, "uuid": "50430b85-4732-485e-b408-b68e4184cd05", "comment": "Malware payload", "value": "fbc38bb56efa2db6089956cc060acee2123717d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963669, "uuid": "2d4bbc4b-935f-48b4-90e4-898ddbc7324f", "comment": "Malware payload", "value": "ed789aa442f5bf33970c2b11c14225fde062236618297bbcfbff70aabdf6d0211355f1c401ec59d1dbadd080f489a3c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963669, "uuid": "c4ec4ce5-8f97-4ae2-8268-4763148e7f40", "value": "T148A31237A8FF5AE0C7465AEB91C6DA907F328592AD73A390F9D58E9619503107C80CF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963669, "uuid": "cdbd493a-3dc9-44bf-911e-c4d61026a18d", "value": "3072:4BMuyQZp/lDqT7Tldx8S7WBrz4u+qgw2uC:4TyydDqT76MenC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963669, "uuid": "d2a035dc-dd58-4862-a051-038c4c66eff1", "value": 107348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963669, "uuid": "2e007589-61a0-477c-960a-ec064d64e732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963669, "uuid": "9d15b48c-9a00-480f-aa53-a21740fc1176", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a29d3a-7ee4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783965530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965530, "uuid": "d5260646-7ed6-46b8-94b0-93b589bf7072", "comment": "Malware payload (Mirai)", "value": "e47d354b7a485195b90f2ac77243412c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965530, "uuid": "d6903564-85e2-4cd4-a562-abf91fa414b7", "comment": "Malware payload (Mirai)", "value": "6b7a81fd67e8e470ca2513338a511ceaef6f04d034f9fc4fb54c992135524dee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965530, "uuid": "5b901982-fd69-48c4-9ff8-10772c10f7c1", "comment": "Malware payload (Mirai)", "value": "e22c58a3698a5c8ca50dd3315a495f8fe7cad58e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965530, "uuid": "c3446c96-d0f8-4832-94fd-f689f446e8c5", "comment": "Malware payload (Mirai)", "value": "340741901d44ad84308c8d4f36ad85f321669834a7cf32b0e917c4a7991a2cb4139168132479122c2a95c41c28b144be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965530, "uuid": "84938369-9942-4c14-947d-ba02e96da62e", "value": "T14DB31899B8D29A22C6D316BFFA4F428D773663E4E3DF7107DD145B21338752A0E6A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965530, "uuid": "29ae11fc-ee3a-47fd-8b9e-570169856836", "value": "3072:gLLU/lW6pdDDz8eciU5IFa9MPfJMTWLK+BnbV:gLLUA+oecioISyfJ3KGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965530, "uuid": "bd16023b-8217-4bac-82bf-6a2ecc15b209", "value": 116084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965530, "uuid": "0a792e46-0a35-4f1e-9c78-03284e4bb83e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965530, "uuid": "a974fd91-188b-4c7c-a7a3-522661eae38b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d059c500-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1783906393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906393, "uuid": "7634efd0-4747-4f8c-8f6e-e3bc11747284", "comment": "Malware payload (HijackLoader)", "value": "4e0c131538aaff9a55fc0d9e025f87a5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906393, "uuid": "5b33b10a-e4da-4432-b21e-43eb9580dace", "comment": "Malware payload (HijackLoader)", "value": "6dcba233968441cbb50e14bace526d0a22e0947b392973332d94166a9a064a1a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906393, "uuid": "21b07c2a-b371-4241-bc1f-dbe43acc0a9a", "comment": "Malware payload (HijackLoader)", "value": "0f4180a105cc71030fc8a5d6e1b93b5787c4c6e8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906393, "uuid": "57951a59-aa62-4b50-b48e-6e251562b3f0", "comment": "Malware payload (HijackLoader)", "value": "fd6102ae28b24660a2124595f5fd6355db40e5c18501966fea06c5b246ad2d4f9707f41f121899fa3f5ae41c6e9d9998", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906393, "uuid": "f43ab5bf-2807-4661-9b97-1e7c2bcf880c", "value": "T1F186331555C6EA85C8690A3B8B63F17CE4B2DD64BF34C9EE2AB2350C31711F4EFA40A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906393, "uuid": "1f1384ca-c301-45c8-827b-faaf6d52b4b2", "value": "196608:bRjSXalr76B/FISS+lJ4hvzzAUEb+C7F9Jd6k:bskQSylJ4hvzVE9Jd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906393, "uuid": "521fe2f7-5bfe-4976-a449-e94d1b73b25e", "value": 7872512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906393, "uuid": "b8faff18-2b96-4c89-afa8-5d3a8de9e1a9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906393, "uuid": "07656d6e-cfc8-457b-aee1-be02ade046ed", "value": "HCUQAUTJ.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be707d14-7e70-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783915812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783915812, "uuid": "46991add-5eea-4d2f-a3e3-c75c21006f19", "comment": "Malware payload (Vidar)", "value": "f8b8e83a20949a56efd370b238ff2599", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783915812, "uuid": "d0499e6d-21a4-42e9-9aed-963bc2183fc5", "comment": "Malware payload (Vidar)", "value": "6e42c22a3fc0f378992af1bab53101e2a755593cfd9f98429ea64563761854c3", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783915812, "uuid": "2a34ec48-7e29-4e44-8bda-2a8129804b06", "comment": "Malware payload (Vidar)", "value": "38320f6b73ee1ffca21dc270337e6bbaf9d23b14", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783915812, "uuid": "f0b241d2-ee28-407b-948d-e03f5dc96fc0", "comment": "Malware payload (Vidar)", "value": "36d630298f57ff43e56b23dece93b7dd50009c3e385a9a790c54dd95a82718cbf9f73126edf283ff0013cc4d5486ae92", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783915812, "uuid": "3a0e91f1-dcf4-482f-8237-888466dc032d", "value": "T1D5850116655578E8C86452F790E23B1EA722FE6070C08EDA2EDE31762E357C1EDDBD20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783915812, "uuid": "3da2fbf6-091c-4be8-8d1d-3bb554228134", "value": "0a847fa7fa9242fd3717b8ec830ccda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783915812, "uuid": "0a46b2e2-6128-4758-9a46-0696819aabfa", "value": "24576:ZnWu1x21s4io4eoLanloTXTmmysbj8MpTV5vM/3C8/Zg8k1esZY0GUi6ybuid2nd:8B5jgJFb18JsZCyyJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783915812, "uuid": "8dc6c212-d756-4f97-89ae-4f7fd6b3ed48", "value": 1748208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783915812, "uuid": "b85d3558-ac2c-4a43-b67b-e10dfb221032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783915812, "uuid": "8ef0545f-d1f9-462d-8792-2c959b6e28c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a050c427-7eac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783941531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941531, "uuid": "d70be4f3-26c2-4f89-8ca1-8905bb506653", "comment": "Malware payload (ConnectWise)", "value": "7042049346c46c913aa24e951a0c39ae", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941531, "uuid": "b792f7a4-a62d-49a7-aa9d-f2f6fa78c0a3", "comment": "Malware payload (ConnectWise)", "value": "6eb36447883376c1cc14129e77d8bebec87a1ac31ea069442ba76949797da3e1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941531, "uuid": "63d769b6-4df5-468d-8159-4111448137f5", "comment": "Malware payload (ConnectWise)", "value": "8a065b454a71fc3e23e67fc006afdaf279ed06da", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941531, "uuid": "62547a5b-21a8-4114-a0b8-fa1f2ae48464", "comment": "Malware payload (ConnectWise)", "value": "49045c292540e12733c23c9e779940f8d5e2a583db95a6a10825c7eb29d178c7fd88cb4a9c6674ea7667a6a4793dc95b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941531, "uuid": "58ea5967-d7e0-42f8-aef6-e552ec2a4610", "value": "T154A5451960223F433C3C1256F837FABC6D514F8CE625EE32ADB10577A309A95A784F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941531, "uuid": "800ad3fc-15c4-47eb-8184-71b8ab63aa77", "value": "12288:kOrt/VnVNMZIOdQAEWq5eTcIivp6Vm7s57q54xNOhqQrNpDX+xRddkNCPhHhYJ:prZkZQe5uGVQr7DubfZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783941531, "uuid": "3621fa49-e3eb-4413-a987-30b7f83613a0", "value": 2255195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783941531, "uuid": "173ac659-2a90-4305-b077-034ed5376bde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941531, "uuid": "6fbc21ba-60df-4115-83a5-f7dca18d2eef", "value": "Secured_Document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01fade5-7ee2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783964750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964750, "uuid": "0291ecf7-ba3b-417d-8e30-097675d9a533", "comment": "Malware payload", "value": "d19bd927216575b241d7381c3937c5b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964750, "uuid": "78141a65-722c-473f-a0d9-3df24286a0fa", "comment": "Malware payload", "value": "6f14e35c6956357ac4c6ccf336f3a067ff6163c37c68e2dd1944b7cb17f663dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964750, "uuid": "b31f866d-cd2b-4cd1-ade3-833001f3e95e", "comment": "Malware payload", "value": "e8b5866b80e8bce1dc56c6ca37a49ee3b679c2be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964750, "uuid": "a6efda23-37d6-48c3-b79d-3583e2841ebb", "comment": "Malware payload", "value": "efc73c0695e7edf065395e548551efba46891fb305cc18b995c714e8c96c41b687b10fce8385973e0f702af10e62ae48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964750, "uuid": "f9d9f354-37c2-4425-b3ac-dc70ca5d5e01", "value": "T17BB30205D01DBB9FC3C9E5B6A41FF738FB4A512740B3D3E77AAC836A29A1440AD944E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964750, "uuid": "dedb4e95-7b9e-4284-93db-3198b7c24fcb", "value": "3072:LXq7wEMANokuzan4JAEnnMQtbGKUZsPm1jF0aT5:LasEJN6I4JAEMehUS+JFFT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783964750, "uuid": "206c9a2f-50e8-44a0-a899-e87257ded5d5", "value": 114932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783964750, "uuid": "b20f5488-2ef5-4bbb-9c80-5f0d1e7610e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964750, "uuid": "5e6cae3c-0052-4619-be3f-e4e7095c2607", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b8505b-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963307, "uuid": "2598d05c-dcb5-44ca-9525-0429eb56ab37", "comment": "Malware payload (RemcosRAT)", "value": "00fbb1a922f6727b336c8f8b1d04b2f2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963307, "uuid": "cafa7a65-07e7-4650-9740-8b741723447f", "comment": "Malware payload (RemcosRAT)", "value": "6f7125b0b1752816c938a2de494d8ccde6f5e62c5581e7d8ef026833d91ec9d3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963307, "uuid": "609d6b44-4012-467a-a1e5-f49b53eb9b58", "comment": "Malware payload (RemcosRAT)", "value": "1d8ab0eaca988be90a0fb545a7973f82e0fc7d34", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963307, "uuid": "2c364d39-e099-442d-8635-a02159d7ea79", "comment": "Malware payload (RemcosRAT)", "value": "3537e2c651940eac52433e76ea5210fbce1e45bc909fad661582ea801ea782cb44ff8bf6230e589fc96abc841fc377ce", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963307, "uuid": "a8f18322-a194-462d-9d2b-6cb5a7a08561", "value": "T1C7D25B2433AAC106E9469A724DC4C2DF5B31BD53EE53860B32C9375F6C3A9A4ED23716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963307, "uuid": "4f9bb29f-3508-40f2-80de-1c80c9909dbb", "value": "384:RNjip3kk1a/Fh8hcHYRFAWoZ1tGPdGhrVgiB5xX5sIM/NX3:3Vk10L8hc4fCtGqxzBvX5s3/B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963307, "uuid": "1ae5b712-50c4-4f9f-893d-9616e0ec7ab6", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963307, "uuid": "80b514d9-f3fa-48e5-9651-c99d80b25a84", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963307, "uuid": "85117476-bac4-4e9f-8c76-cc038476dd60", "value": "\u0417\u0430\u043f\u0438\u0442 \u043d\u0430 \u043f\u0440\u043e\u043f\u043e\u0437\u0438\u0446\u0456\u044e.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983ad0ee-7e58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783905440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905440, "uuid": "98210e16-6837-4875-b793-f2d6a7f1c137", "comment": "Malware payload (Vidar)", "value": "695518699d12584e74873f517d311aca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905440, "uuid": "39a1ca30-d705-4eec-a6fe-ad4f6e8e20e5", "comment": "Malware payload (Vidar)", "value": "71911c8f6eacf5ba5414bc8a66ac83a981aaf4d1141f5117ed6c2ad196c558fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905440, "uuid": "b9370a27-3a99-4a1c-8ed3-c3354b2db85a", "comment": "Malware payload (Vidar)", "value": "ff977c5814d26d01cea48ba198c0183f4d7cabe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905440, "uuid": "a15616b8-15cf-4692-abdd-a77e5143e710", "comment": "Malware payload (Vidar)", "value": "48199abf331bf8dc3c811d47bfe04af38718d2da33de1102acfa1d2c5b8064e3e409f828dc5f52f6cb68236c1a629911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905440, "uuid": "ef7a54d2-efc5-456a-8447-9361df6a62c1", "value": "T1FED59D0BBCA149F9C4A956368CB652927B35FC058F3227C32EA0B7782F766D09D75390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905440, "uuid": "a0ffda32-3ad1-40d4-9755-9ace478201a9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905440, "uuid": "52f207c1-ba71-4a56-a013-ab75d749336e", "value": "49152:KDs8alB6Mw6E0vhK46wLpYSKMbO5FEj/Bj8eg7qzzMRk9OIIaN41lYz+Q:KDODyWpwFEzBj8eg2fMRkAAN4bYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783905440, "uuid": "0f4950e1-515f-4327-ae44-cf7e8a54da91", "value": 2957696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783905440, "uuid": "dd34f01b-d494-4bde-84dc-9fa713834d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905440, "uuid": "9407ab08-c3a9-423d-bc21-5da74694f808", "value": "component_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf90c1b-7eeb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783968639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968639, "uuid": "a6694104-83cc-4188-97bc-896ea51c9df9", "comment": "Malware payload", "value": "8b35ee8435fff328b3b7b4be7e94c5f8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "pyAdmin2", "colour": "#E6D71F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968639, "uuid": "1f3c3222-1587-4549-8d19-bbde1bfc0253", "comment": "Malware payload", "value": "71fbffcbab0e585ae33ff277a076366955661e39fee25b62c9f59392263025b3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "pyAdmin2", "colour": "#E6D71F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968639, "uuid": "8e371559-6126-4e80-831c-41e320c22304", "comment": "Malware payload", "value": "c4db4f01f13e2074b5367959119736ac5f7ea0a5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "pyAdmin2", "colour": "#E6D71F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968639, "uuid": "b73461f9-bbaa-445a-9033-c7967cb7f301", "comment": "Malware payload", "value": "0d92193913e12b9d8c5c99df19e139e67d893c1c0232d039ef3515785ed1200915635b0bf8a76631bdc591c3dd6c6072", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "pyAdmin2", "colour": "#E6D71F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968639, "uuid": "c08cd079-5b8c-41e7-b857-214b432f8755", "value": "T13491FE0B7922E0B4443116EE6A1E742DD66285BF4600445E7D7C44DE4F3EB7ED2682EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968639, "uuid": "83faf51f-f16d-44a6-9cb3-043e2726f8d2", "value": "96:ykjVUKd4WE/RlPj6LacSmt/eEje3kJsTNaFr/Q:9RvE/XPmt/XarQB/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783968639, "uuid": "ddb7c3e0-8a66-4a9c-a8ce-7c0f4e6d229a", "value": 4454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783968639, "uuid": "2cd66359-fc57-4c89-b070-ad1469256aa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968639, "uuid": "8da955af-1ace-48cb-b01d-e02c44bce0a6", "value": "request.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375944e0-7e56-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783904418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904418, "uuid": "b590febf-1eae-49ac-ae19-c7931e826e92", "comment": "Malware payload", "value": "84f832c4990c37746aff6131ab8f9099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904418, "uuid": "e73e84a7-2eb6-4ffa-8089-7b1ade71626b", "comment": "Malware payload", "value": "72f4226176d79e9a437127a0cf513c6f8b0b74f5ff3c79553fff23f08090b55b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904418, "uuid": "f718027a-c84d-49f7-abb5-0514d27839db", "comment": "Malware payload", "value": "69082ff2be135607f369b0e12f0d6f660188795f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904418, "uuid": "1b35d67f-4993-4068-bc51-83616147cd07", "comment": "Malware payload", "value": "424742665c2737c131cd16f538764617f1488be50b2b3fef37563c944058067b8b7b81d3334cc5fd1cb00c95783456be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904418, "uuid": "3dc46b53-06cb-4f8f-84a4-c88479a8607e", "value": "T1DBC51227B26224ACE55BC47487CEC1B2EA39B46502267B3B7BD896313F38C614F5D712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904418, "uuid": "bb857ce5-af96-4330-84c8-af0bba5f640f", "value": "49152:pS/qu3q+ov508MFm5NNUgn1A5JUMt6oE5/p7SEi3+/xQaSk25s3nvL:YiCtovKTUvmMy5qUVkf3xQa52+3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904418, "uuid": "064ec873-35c1-4471-9fca-7d5098d255b1", "value": 2736840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904418, "uuid": "d636924a-7c8c-4eca-92e9-288e836476db", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904418, "uuid": "d224c94c-9d5d-4156-b703-fcc5592da4d9", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14735fb4-7ee4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783965348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965348, "uuid": "e33710b8-3465-484e-99a7-5b8acef8b10c", "comment": "Malware payload (AgentTesla)", "value": "9010a15f77301b63cc31f68af0e1a62f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965348, "uuid": "ec87e456-aa30-4b57-a74c-0b4b5833cd7c", "comment": "Malware payload (AgentTesla)", "value": "7400181ed90f288886881c12b8147f905e502d3ab5022836f3663b9bbf35529f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965348, "uuid": "90fed543-bbb2-457d-b483-4e11732f98e0", "comment": "Malware payload (AgentTesla)", "value": "01cc2e22deb274c5ee3d80a7238cd5534e1ed652", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965348, "uuid": "f80e26f3-e2fa-4fa3-8fd4-2917f6fe9f3d", "comment": "Malware payload (AgentTesla)", "value": "35803a6b00abc5049038eb0e936e5abd758cf097b2d32f1b867f9881362c12f830a79112da59b07ecf92d083ba9ce6bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965348, "uuid": "5bd1ed77-155c-469d-9977-f654b56f4c01", "value": "T1E23512A89700D513C9461B380D73F778226D6EEEF801D763ABE87EEB7977A154C00286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965348, "uuid": "27963611-e623-4f33-85ac-1601c50d623a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965348, "uuid": "a83a8227-bf52-48c5-9f88-5979530163c5", "value": "24576:p0jmxcZ7Vl7XBVaFd39Qy8g7iwr4en1ZcVJgPaIeZ:QWofBVaP4en4jgXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965348, "uuid": "2fc6f889-7672-4468-a677-79104fe78d02", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965348, "uuid": "a095df5d-3a14-4e32-b08a-2864bcd2f692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965348, "uuid": "0027f8c6-6b10-4f0c-b5a2-703cffe0d508", "value": "Materiali da acquistare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38126530-7e96-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783931907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931907, "uuid": "8f14b6bd-def5-483a-a09a-54261a5d7e9c", "comment": "Malware payload (RemusStealer)", "value": "474de2155ee5c575d408806412c90411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931907, "uuid": "f3287508-4633-4d8c-ab83-2a3ba087f3cf", "comment": "Malware payload (RemusStealer)", "value": "746c06f05b8e3bc93d6495a6c447c3c1874bd77011c33b0bcfe74ae27addbfaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931907, "uuid": "cf987852-200b-4a54-930c-4c71fd935554", "comment": "Malware payload (RemusStealer)", "value": "6ce65e50e8b91686e401e7fda41935a04503a2a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931907, "uuid": "795c13df-e929-4e9e-a52a-1a8d3a249734", "comment": "Malware payload (RemusStealer)", "value": "1dfff23c33d73247d6d09f0ab5f58f19a04163ca31038d10475a416a7848ed5d336636f00531ac9b7bdebbe0af5b0298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931907, "uuid": "a0e463b7-87ec-45f9-b526-a6119da68cc0", "value": "T1EC548E59B79958FAEE77813CC9524605EA727C124760DBCF03A04AA72F237E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931907, "uuid": "934a8270-4779-40a8-a49d-ae6240e263d2", "value": "67f6728bb9c2c56c262f6da70935d9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931907, "uuid": "dbdcbcdf-9bb5-43be-8fb5-ddebff27d745", "value": "3072:RIRFzY0sWUjOkFE8cH9yn5XYITuozPMwVC/5EIa6ooauBoLTwIzIud5OdgMHf89l:G++Y5ICuo798HkBHz79xP2R1DP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783931907, "uuid": "c5dba628-b179-44f8-9cfb-c89b5d3657ad", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783931907, "uuid": "c212dfe8-13dd-4f68-b953-54fc8ac29d89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931907, "uuid": "7498711e-3449-4452-a663-687416d81977", "value": "SecuriteInfo.com.Trojan.Siggen32.64474.11966.12338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053b8bf6-7ed6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783959310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783959310, "uuid": "5e6da0d0-561b-4b45-b4fc-5d32aa6aeba9", "comment": "Malware payload (ValleyRAT)", "value": "026286f87e3719a78ade47685a01e31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783959310, "uuid": "7cc9d4b1-3a22-443c-b817-2221ab941e55", "comment": "Malware payload (ValleyRAT)", "value": "74dcd1f64bd3b43cf659359bff1f43131d43b4e07f3a3aa2a1f74d6e7970be09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783959310, "uuid": "2c84db8b-0552-4692-b82d-8ec537608424", "comment": "Malware payload (ValleyRAT)", "value": "26668a26d5eca6ecde87587b76b1e500cdf2f915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783959310, "uuid": "f9045abe-ed87-40d8-9b45-47f465ab15d6", "comment": "Malware payload (ValleyRAT)", "value": "f76225117247a72ba8675436dc6cffaed2cf2a2941b2ccf776f1a7fa0e33fa7f9a9ef4689408452cb2a604ee571542b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783959310, "uuid": "7fe7d173-08d0-4c3e-9407-28c96084139d", "value": "T12CB5E87BA5A183B8D38DB67EC163A744D433B1764732D0EB61B003668E1A4D19D3BB78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783959310, "uuid": "4c083420-29fc-44da-982f-9f440d1883a1", "value": "e9d6723ad0e9063b525f384eb48d5a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783959310, "uuid": "6725c4e8-d52c-46f4-9d17-0a3a1e8759ca", "value": "24576:tgMucAicT6LONFHQPqJWNhBsEnCVLPiSaNYB59uXDf:McAicT6JPqJWNhCEnCslwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783959310, "uuid": "50f54baf-e36b-41ea-be24-60fb750a97df", "value": 2351968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783959310, "uuid": "858b6592-96b1-471e-a147-98919653add0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783959310, "uuid": "626059ad-1b8a-43e7-9b44-fea846d66c70", "value": "026286f87e3719a78ade47685a01e31d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ac18cb-7eba-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783947652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947652, "uuid": "abfac6ef-b0cb-42ba-8601-43a115386bbf", "comment": "Malware payload (Mirai)", "value": "59ec0c571d6fd73497c1583480a67a75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947652, "uuid": "e64ed783-4355-4c15-9da9-94b9ad68d1e2", "comment": "Malware payload (Mirai)", "value": "757413ffc45f52686aba1df87c6d5313c80558f944f54b1dd77a848f1763734c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947652, "uuid": "34e5ca22-5c06-46c3-a37e-066e3bf34998", "comment": "Malware payload (Mirai)", "value": "797a4281baf86d55b02d47bbab673f64351ad6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947652, "uuid": "9af79cb3-3730-4e7d-a7ff-4aa49c738aed", "comment": "Malware payload (Mirai)", "value": "c9589b32c8743a2c94deafc3376e67be5f73d693430a6e40ebe286baff6f7ee8bda090460463a5188644707c1df28700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947652, "uuid": "9d840544-9b6c-4a52-a542-c16bd48f5bb0", "value": "T171F3D627AF602EF7D8ABCC3781F9870924CC655A22A43BB57574E424B64B54F4AD38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947652, "uuid": "1a2d103a-a3c6-4364-8fd7-84a5264cb270", "value": "3072:RvVdB5Ud8ROeRVsVX4N8Adx0uxhf7Bnbe:F55UUOeRaVX49dx0ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783947652, "uuid": "e399bf15-c7a3-427c-9952-22a030d879a8", "value": 159356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783947652, "uuid": "e1fa50a2-4fd5-4413-bb7c-bfa828bdbde1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947652, "uuid": "faf82c3a-c7a1-4bee-b187-ed0c19254e64", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d0776b-7e55-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783904221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904221, "uuid": "2b8e5234-b3cf-4f1c-917d-d33ba0487dfa", "comment": "Malware payload", "value": "8a489e4108817b877522ad4b11f7cb9f", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904221, "uuid": "b47ba9ea-f96e-4ec4-9f18-d20df1ff9be0", "comment": "Malware payload", "value": "77ccda79bc51c0da74fb66be3e0098bc14f6005770d8817a1786591ffc993cae", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904221, "uuid": "a9cd811a-ebb5-43dd-82df-99616d41c4b0", "comment": "Malware payload", "value": "d6b8a17c3f5483a8d091882e00e865fa40029c65", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904221, "uuid": "db0d8201-9c58-4349-9d72-12edd410c6c7", "comment": "Malware payload", "value": "f555854aea47ea70f327a378e38ace7dcb51b72b5a7f9e658a5e427fb5a6aeae323c7f6b3b45498ddda26d1772954b3a", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904221, "uuid": "3d7d097e-f105-472b-92ef-25d3f271d40c", "value": "T1BC1733579B76D6D2D5AA167001E8C0B0C21FB2BD3ED4B2F01349C724ED289B95DBAB34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904221, "uuid": "5e35c952-03a7-4bed-b9cd-34dbfc36ccd9", "value": "393216:NSQYuOEonTcAJnz/vmSh3u4Q3uTWHqsEngi1S/zakw+ikXjftu:0LEonTcAJp+LuyFCgigakw+ikXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904221, "uuid": "eba69e1c-83ef-4210-b482-d542758cb2b6", "value": 19079168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904221, "uuid": "19529947-4586-4945-af3c-4bfcb5de8a73", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904221, "uuid": "7fc9631b-4752-4d04-aa72-df6d169b956b", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de04536f-7eb3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783944641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944641, "uuid": "c06282b1-d931-4d5b-a43c-6a921fae63e8", "comment": "Malware payload (Formbook)", "value": "7f3edcd0ad17cae6ef95cc16e208eedf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944641, "uuid": "e5f635f0-c1a9-45e4-b2e2-2367718d2083", "comment": "Malware payload (Formbook)", "value": "7906d425e122ae7f4922dbeff8c261be021a921c5f13471a470c60c583280504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944641, "uuid": "bf15aed2-8ca3-4827-bfc9-4c49a0e5d38c", "comment": "Malware payload (Formbook)", "value": "57a314d4466848294bb2c2bdf87c666185574b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944641, "uuid": "25098a95-e357-40bb-82c3-eb2e8bd4bdd6", "comment": "Malware payload (Formbook)", "value": "a7538054372e0678ffe608337f354a452d9452bb65cd2d60301476eb0cb8c22131bcf2f7276c15a7168db5508f5f89a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944641, "uuid": "9590d1bb-fcae-4a29-a79f-58184a0f0b40", "value": "T14C351288B741E202DDCA43340EB2F77926A85DEAF900D317AFED7DE77A36A454D04152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944641, "uuid": "4801f80e-1b13-4eba-826a-934708af2787", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944641, "uuid": "05ba94d6-c984-4127-89d2-bd6dec8803de", "value": "24576:kUptt9+EdecK/7ZhsDRWJylhCBqxdU6pq0AGQeZ:k4tt9fej/1uWJYUqxK0JQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783944641, "uuid": "894f5646-b8ad-4c42-945a-6df27f639a28", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783944641, "uuid": "68d6626a-7d52-455c-9bea-5dffebcf3373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944641, "uuid": "5f357938-80cc-4feb-8a20-8ecf0dabc2d0", "value": "Nostro Ordine 264418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c48c102-7ec2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783950732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950732, "uuid": "c42d3576-a7b3-4fb4-ba1c-291591b397de", "comment": "Malware payload (Efimer)", "value": "e19b9699ef34073da3ed7b181d063ddc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950732, "uuid": "e1695e96-b0a6-4127-8792-fadad17daccd", "comment": "Malware payload (Efimer)", "value": "7a8e12bf814ad24df54b360d6f80bd5abf196b948ed3fc419631579fd14ffb88", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950732, "uuid": "2ffa4585-89a7-42cd-8e6e-5f65895428fe", "comment": "Malware payload (Efimer)", "value": "08ef6344faa6ba44127c418f11c018959f2b2ff4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950732, "uuid": "6e99b540-5631-46dd-a708-7415287213e0", "comment": "Malware payload (Efimer)", "value": "71dea15ec0f01ee0d9d6d3ea6327886eb73d2fb76612ad2ed7412e83cfc6b5274c5e94de181bdb5c868cb1e265e27bcf", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950732, "uuid": "d45e0714-207b-4573-ad70-e2aeb12722db", "value": "T12DE6331866D417FEE8B3803DDF73AA53E9A930720776C5EB078086A16D171E18D3D6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950732, "uuid": "a47ef512-8172-41c6-b6c9-a0f17bcb36c1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950732, "uuid": "31888ba9-55f6-4090-8cc0-e0656d4ac2db", "value": "393216:4Ti7f4kS6b7EPljikJPhXMCHWUjXfcuI3/PGTAI:4TijVS6bc2oPhXMb8X0H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783950732, "uuid": "b84acf2d-9f30-45a0-84ae-ec2ec045e27e", "value": 14330224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783950732, "uuid": "24a34215-acee-466b-b424-4c0abbf068a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950732, "uuid": "127bc8f7-9870-4866-affa-5b7cb86f2ec6", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2805ed-7f13-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783985598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985598, "uuid": "100b015c-829f-4256-b301-c90a75b9313e", "comment": "Malware payload", "value": "3df67d1d03f2c5e2ddbf0c15d23636ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985598, "uuid": "2b10c3ed-0995-4c7b-b8f5-799ff8e4ba0b", "comment": "Malware payload", "value": "7b9959d43d48dadc1139e45c07978eea4f7e314c328050e860c538dbcd48ede6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985598, "uuid": "0c0e8ec9-e5fe-491e-85e8-61cc963ba2e1", "comment": "Malware payload", "value": "a373f5e0b90b1cb62f1506b7954a0f376d3d6f41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985598, "uuid": "c4a88f09-bdfe-4032-abbf-6d0c722fc640", "comment": "Malware payload", "value": "574c3ea016a2624196fb00b7fb1383175d54f960ac5f0a4897398017cd48954b1327c1c6aa10c4705dc7343f451dcede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985598, "uuid": "1e194851-75ac-4282-8746-35dc30b005e4", "value": "T1B4A312EE37FCB63894F87939DD98E5007E2D739514FBB0B368585AD10B80069A0D93A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985598, "uuid": "e5b76ba3-db0c-4506-89ba-484f1124a369", "value": "3072:WZ6srvQPEFQcpowVzK1aIyvQFvYzvWic/aBI:WZ/rqhZyveYqi7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783985598, "uuid": "0f58f0f5-ca5a-4877-a825-ad1fa8b3652e", "value": 106756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783985598, "uuid": "26df7aad-b036-49d9-9634-1418181e3dca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985598, "uuid": "06907ccc-28aa-45cb-a82f-057fb5a9594f", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b95e28-7ea2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1783937384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937384, "uuid": "98122a29-d72e-474c-b597-7d586a3d0f21", "comment": "Malware payload (PhantomStealer)", "value": "5b7d0f9ed1cf7a31311fa3809098ae74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937384, "uuid": "64f8902c-caeb-4144-bc7e-db86b0bd2a29", "comment": "Malware payload (PhantomStealer)", "value": "7e732b4df4080ac0e000a70c84428aade4334da642001f1afe47683482c4f7a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937384, "uuid": "e9d52acf-ff07-459c-820f-67807f195f8d", "comment": "Malware payload (PhantomStealer)", "value": "f65bd34baef2ebf7379305f54c61e9f68a696792", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783937384, "uuid": "d04a1d88-7062-4525-94eb-ff9d6ee08c5c", "comment": "Malware payload (PhantomStealer)", "value": "e5096babac859b8a55f785cbfe23779b86464958704be7b5070475ec96d394837bdf2dcac679049066980fc0b563a805", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937384, "uuid": "e69db906-c55b-421b-99c5-14c9442c5052", "value": "T1FFB502D1EB53512493436EA7A8B47345EB3EBB2FD167DFF82D1587DA3640A08A0A0734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937384, "uuid": "ea7c5705-a28a-48b7-87e7-cb6dae078d4a", "value": "3072:ZoU4bKMUcwzlSQ4KU0iWG4aGM/FqHB1Gdj6WHoSbO7sQ:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783937384, "uuid": "77121519-fc54-420b-9d99-0ec52163efce", "value": 2324009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783937384, "uuid": "a6aeaa9b-f50c-4609-85af-1e06b522a9fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783937384, "uuid": "ce86ba9c-6c27-4f8d-844d-32b129bf3d89", "value": "Product List.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57eb001-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963444, "uuid": "ee5f176a-3305-4369-bde0-2cd9d6b3c518", "comment": "Malware payload", "value": "07a8202fc35395523a8a69ba571babab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963444, "uuid": "2e1c6840-5261-4f8a-be80-d50653bc7c6a", "comment": "Malware payload", "value": "7f1f58c97e0be5c57a9c2484126f9d5e3830926d50d9864bed681308d8c62e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963444, "uuid": "7959c9b8-2898-44c5-acf1-709295eea8ed", "comment": "Malware payload", "value": "3e87e6e2001e4699caa05a5b65f3b31aa0eefb55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963444, "uuid": "08088db5-d462-4850-bcab-d0e52a2a63ac", "comment": "Malware payload", "value": "3e1f205bc6b1b77948b61f50c65c9124db956df8af3f58d9789af945925968c703c574809b3373d82aa3fd8de1f90b97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963444, "uuid": "eb41093d-7e49-4623-ad19-317c42d8debc", "value": "T18DF55C4359DB0DE9CDD66BB8A1D31336A734FD748B291E3AA908C6315D236C4AD2FB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963444, "uuid": "4ce2f36d-8ada-4a31-a8c1-506ba88305e5", "value": "f2a26a6440715789ea0d5fb02c754053", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963444, "uuid": "e0e86185-833e-47bb-9e70-a8cf26c940c1", "value": "49152:vtMZsBsttNunDnF5ki6QYleT7p72KNVP22eSgFeKnyAYqIa:1MgsttNun0QYlu7pRV220EKyAYqIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963444, "uuid": "fa8ad5b8-9b2c-43d7-84e3-ffb76a44b2da", "value": 3628371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963444, "uuid": "7a78d527-00c6-4833-9b82-1d428af5e3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963444, "uuid": "8817c823-d85d-4032-8f2d-fba42c192a17", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cda32ca-7ea5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783938465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783938465, "uuid": "a1469020-71d2-427c-b8a1-0b4cf60d00bd", "comment": "Malware payload (AgentTesla)", "value": "ce99d6d809efdf477423db196a41fbf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783938465, "uuid": "9f30ad2f-b339-4102-8bb5-d2867cc40b5c", "comment": "Malware payload (AgentTesla)", "value": "7f31b2c417af903470a865c011854acb2d0ce9ef3e497973d54e97fb68db74d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783938465, "uuid": "b66e46d5-82e3-4fef-bf5d-75ec06ec8fa0", "comment": "Malware payload (AgentTesla)", "value": "755181070fe5d2249d5cecee48237bd9301dbfac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783938465, "uuid": "728128b6-387b-4f8b-8359-48cca9c85708", "comment": "Malware payload (AgentTesla)", "value": "0f242dd828d4e7df44f93d4bcff334620c1a965f038968e3eb44b4074eb44809fc7ff92d345d7c5e9e6b2312a33fa679", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783938465, "uuid": "a49c4729-facf-4d84-ad33-d34f4d330b6d", "value": "T18BE5E10057C06DBD82EE5F2AB23FA1EEF2E10DC9119158C6F722BC44FBA67089957674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783938465, "uuid": "7d89049b-0bb6-4ac3-b9ec-09c0abcd9a7b", "value": "49152:oG4P/Bm9rSZY1nxfKHRr0m9rSZY1nxfKHRr6:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783938465, "uuid": "aa866e8c-b1b0-4d1e-9f1a-c1737772372b", "value": 3318098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783938465, "uuid": "a099d9c0-b51d-425d-b44f-a2023de3c98f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783938465, "uuid": "03c5fd54-b581-43a4-80d4-15b0ef74ec03", "value": "Materials to purchase.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ae69aa-7ebb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783947737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947737, "uuid": "a755a5a1-922a-4c0e-9f1f-2464f333da90", "comment": "Malware payload", "value": "cbad150e9a344c24466b26d512e8dd7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947737, "uuid": "24a130a9-c239-4734-a3b0-af56ab78f534", "comment": "Malware payload", "value": "7fa084f7396bbb04cf75b079427c13421d9457853307ee51001e969d50c4db2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947737, "uuid": "dda6e543-1314-45b2-b97b-4d38a01c174d", "comment": "Malware payload", "value": "310ecc91ddef9c1df643bada98fe59ec1d2b9434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947737, "uuid": "0e6a47ba-2694-429c-9887-bc6d45171ee5", "comment": "Malware payload", "value": "3f67af10189de2139fc26afe9400ebf0c6f7bfc650d29b8ed4c037d9db8ce340ed30c1b4f17e2920c8686100d8d90052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947737, "uuid": "68ad06f2-a93e-46e6-a68f-6b1bd4e8f9d0", "value": "T1D404D08223359551C2386FB807337558CE3A0C9A033456EE356CF66E1F86FD9AD2F269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947737, "uuid": "5ccf3b9a-2fb6-4bc7-b4cb-da25c1c23e65", "value": "3072:TEho15QeA6ahEPIr1xWhwiutwtNtuZYYFDtdYtY60nhH:TiohDPIewiuqI+WDK90hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783947737, "uuid": "79807cb4-614a-47e9-8bed-b521c574ea01", "value": 175830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783947737, "uuid": "86a2fea6-bf94-4a34-813a-f8231ca0e64d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947737, "uuid": "fbf4c380-d36c-4b13-9101-53039d80eca9", "value": "528829.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98722611-7ef3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783972012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972012, "uuid": "8118440c-23f4-4261-a847-4aa468cab367", "comment": "Malware payload (AgentTesla)", "value": "eaff05ace23686b52695ea35367725fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972012, "uuid": "57cc1c00-0500-4d01-bd06-4c56c6f8ded4", "comment": "Malware payload (AgentTesla)", "value": "81c589fae253795f2a6625709d192409df2349b929b3ea692b8ea3af08767ffd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972012, "uuid": "ae0138ab-c67b-4ad5-9e70-354afc4f9e42", "comment": "Malware payload (AgentTesla)", "value": "3f81b9e39a7a60bd964308548dda75c1d7bc4350", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972012, "uuid": "102388c1-55e1-469a-a265-9af1da5e775b", "comment": "Malware payload (AgentTesla)", "value": "58e699ddfdaeed8ae19e4de50afe5ac517ba18e2b0d7f533b518fc49294bc424191e1473c6fe0fa8f691d2b64faf835b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972012, "uuid": "2133188e-c1fe-43ff-b130-a7e8acec767b", "value": "T10D45F1256A866A56CB3E0B74C026488823F0CD52AA77E71F3EEDB0F85B737C52D17452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972012, "uuid": "56482e1f-b37a-4457-8139-2ca406a4c311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972012, "uuid": "88dd5248-996f-437a-8d01-aaa906f636d3", "value": "24576:uO02UxAPqGcv/+Duyx42IPOr+e4ggVq3XOI0Nd:uFqPRcvEnyggiXOIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783972012, "uuid": "076f845d-b925-4608-aeb4-2a2b6abe0bbc", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783972012, "uuid": "dce5f3dd-3872-4c0c-9717-2608c0128eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972012, "uuid": "d239679a-0852-48fc-a183-96d6f16555a0", "value": "CTM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66747494-7e64-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783910510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910510, "uuid": "109bc078-2f3a-447d-a596-7b2e405103e0", "comment": "Malware payload (ValleyRAT)", "value": "1211dd54cb40ecaf4e850f52ee499757", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910510, "uuid": "96dc4d44-fa61-4629-b94d-5bc978e24187", "comment": "Malware payload (ValleyRAT)", "value": "81f68f61a8f7cf1accca338fd196051020bf60885aad409332091b759ff818d9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910510, "uuid": "77bc5fd4-0011-4a79-ad72-f7d64f4762e5", "comment": "Malware payload (ValleyRAT)", "value": "22dbb2023acdcc7ddb610da0823c5144c738bcfd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910510, "uuid": "70412ce5-37c6-4999-b26a-0c091ae8881e", "comment": "Malware payload (ValleyRAT)", "value": "1d0b97230bab6cb033191ff8f36d71ad33951ef22e295a8030505fb320e179dde74464b527fcbb562bb7217951b3e388", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910510, "uuid": "39947b67-c31e-4655-9a5e-0149800b3d5e", "value": "T10766336BF8CA2871C01FC7B4915B3A3E75AA7FC24B948D13BBE5390C0D7612488B6759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910510, "uuid": "e01df405-72d9-4090-a413-ee7f8529fed2", "value": "196608:iwc9bNDGDwaf5dcIiUsnQmd9tCf/IJ9xd/mo+FFISlSKG:iwc9V45r1+nQmdjC/IVI3kSlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783910510, "uuid": "4a777835-9664-42c9-9ec6-7f4721f17aa7", "value": 6946816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783910510, "uuid": "19f9afe9-dc3f-4bc8-be8c-939cd2f73397", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910510, "uuid": "161003d3-7b9c-4874-b511-ede755e62491", "value": "app_setup.6653006.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39367675-7e96-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783931909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931909, "uuid": "9060b2ed-bcd7-41c7-98cd-51d37001e38f", "comment": "Malware payload", "value": "c9f1c55b26e7f781b65a96ea8190517d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931909, "uuid": "e0b0bc08-70f3-40d7-9994-a026bac61630", "comment": "Malware payload", "value": "82e8904fd500c596b04786124a0515f1ecb9b9fc8b2187e449c30eeba1ba2316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931909, "uuid": "ddf98628-0529-40a9-ad45-cad2b97f5510", "comment": "Malware payload", "value": "dad71e6ac2ad9e3ce30152f993d0c765008c6b5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931909, "uuid": "cc3de451-ff2b-4943-810a-5b0dfd086c77", "comment": "Malware payload", "value": "cf9ac1ccaf3efcd94c3cf42cfd283d8249310ed45a03623757e81b8c6ab2884363cafb5a0a27aafaff6f5e15a64fcc8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931909, "uuid": "c84b2b81-73cb-45a2-91fb-5306d24bc9ad", "value": "T169961206B28AFD47D7322C345545E32D8A627E34EEE5A30B31BC39AD453B76D8848B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931909, "uuid": "09bd28c7-59f2-4569-a29d-037090a98a21", "value": "196608:dFU5JffPNSfxfuNqXaqtkSIVWH+lY1iP9a5NcINgqK2rICJ+:bIPNSfMGPkSEoOY139nHt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783931909, "uuid": "6480ff91-f2a2-4df7-919a-dcfba90ad3dc", "value": 8670064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783931909, "uuid": "0c73ee05-ae6a-4498-a36d-ca2d1a8ed946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931909, "uuid": "b50d5467-aa2c-455e-b39c-cf45f0985f1f", "value": "SecuriteInfo.com.Application.Hacktool.BHP.95134519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ea446a-7e63-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783910242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910242, "uuid": "e07e8e19-1b21-4921-b6b8-cd20566099df", "comment": "Malware payload (AgentTesla)", "value": "6fc4b9e14bb0cd3cde529d1b5f91d716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910242, "uuid": "4db05f40-5038-40ca-bbd0-af757af0c602", "comment": "Malware payload (AgentTesla)", "value": "856e540dd3765d8e1129070615d6104388a4f8c34179b520acfd87d9efa56643", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910242, "uuid": "9da5a431-aece-437e-bc0f-d7866144f2c8", "comment": "Malware payload (AgentTesla)", "value": "28e80a1b9f93c17337995029b5354c087ec99e0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910242, "uuid": "624200d2-39bc-4395-90ac-3218fb5555df", "comment": "Malware payload (AgentTesla)", "value": "5ab4514a98abe303840f5c3cf67434c1e58058e3f7baa419778e11fb9b5d86e88e6eb4afe1a03c2bb8fd34a08ac19aa2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910242, "uuid": "cf5bddc5-e02e-4810-aa37-3cb6d879ec73", "value": "T1FC751B7A4D2A55828424527E45FE78BCD7641FBD69BB148BF4394B8877330A186F0F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910242, "uuid": "f8e37e9a-f459-42b7-b19a-70a51396877c", "value": "192:rllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllk:wSZ+tGg+jbPlWi8wsEw6lny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783910242, "uuid": "b6867c7b-ae59-4537-a333-383ee6c549b7", "value": 1646569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783910242, "uuid": "863001ae-e168-4f26-9c35-6090ee4f5e7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910242, "uuid": "cb344a2e-6fa7-4630-81dd-5d56cc53b369", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e05dffa-7eee-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783969793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969793, "uuid": "9e78041b-583f-4f62-965c-5198ed772c04", "comment": "Malware payload", "value": "4cca89f9d4f5e6bf767464943d77cc37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969793, "uuid": "4398ff7b-ef02-49c3-a869-dfe2d975b7a3", "comment": "Malware payload", "value": "8602256dc03872979558ef52ba97e43aebdfb866088b95dec044987b7a7c60f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969793, "uuid": "2366b384-2f7d-45a3-acb8-d46134e8a8e2", "comment": "Malware payload", "value": "ab2b36167a59e6663257e132a9e9473d35cb4ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783969793, "uuid": "1a716d65-68b8-4d95-a6a0-5e1e82e218d6", "comment": "Malware payload", "value": "a7e76b4fc054668dbf3b61f553ae1e4d1e381c47cdd7ef670d860e46bd67d7bcf50b922d58ae41433bd46a1cd1b43ae1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969793, "uuid": "2efc7afc-9880-4680-9c59-ea112e740efb", "value": "T10BB3125651145FB8CCFBEA765D0363B8863B73BD8B63A2AB0220CE3D44C9C53DD26856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969793, "uuid": "440be433-6251-4691-aadf-58175e8216f3", "value": "3072:osN34BgN9TT0Zp+Dobveet2ChtJ/K/vZFI4:5NkgHTloJzDJ/yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783969793, "uuid": "42cc22ef-eaf9-41e5-8301-ea2df616d500", "value": 115676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783969793, "uuid": "9ad139d0-d43f-4a0a-93b2-fed32a52ef60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783969793, "uuid": "87b16fd1-c74c-4803-9948-f98da5426d32", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c4a76b-7e90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783929303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929303, "uuid": "47ae800e-4851-4067-b431-c7688853089a", "comment": "Malware payload (Mirai)", "value": "ed012ca01f535c37e6ebe19a7932c4be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929303, "uuid": "4970a257-1b0c-4e48-850f-86a4992db312", "comment": "Malware payload (Mirai)", "value": "861b1dd07d04682f8b9efdd2e150bc2a44968390eb6d1ceab0254a4ae47ea4d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929303, "uuid": "5df58ee6-39c6-467c-be68-840080dbebaf", "comment": "Malware payload (Mirai)", "value": "fa49e2eed12da0df998ca859b1f4cad46d205a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929303, "uuid": "2a6cfb49-ea5a-407a-92c7-03876467f513", "comment": "Malware payload (Mirai)", "value": "74bbac08cdae6c6114e3bc1d6142152c5d4a5f521c8f9841d0f10bcef95e836553aa6a0f92eb328e6965b54312186fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929303, "uuid": "4dcac313-b842-48c3-970d-74f9c8e3e30d", "value": "T129B33B89EB57E0B0E85281B038BB97374A7AD4715139D6C1FBF12A716C32F025A077AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929303, "uuid": "84dc383f-ed7a-4b88-89cd-7af78d3d8d76", "value": "1536:Xu7wKJmtoeZ3o6CBrq0Jpz2J9BL0jj1V3N4r1bc/Rn/2w0eQKw+dI8Xczvi0Ls3i:e7JjSY6ClhRAixIeczvrLs52A9PQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783929303, "uuid": "b823e06c-0b89-40e8-b918-19523964adde", "value": 115856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783929303, "uuid": "8fe2b939-ad6a-447e-9284-3865d0d79903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929303, "uuid": "5c67cfb2-d90b-4a4a-b525-2c8afb6952ee", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ea3a95-7edc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783962230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962230, "uuid": "0ac18d89-e906-4646-b463-d34ef2203168", "comment": "Malware payload (RemcosRAT)", "value": "1801babb2e63dc248042f2c77be25e0b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962230, "uuid": "99f60439-afd3-4788-ac48-5c4d1ad65deb", "comment": "Malware payload (RemcosRAT)", "value": "87cde2d7702b51d8a8a9257388fc9253e26a128fa0bd54e3da14bce8b5c5c77f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962230, "uuid": "96756a3d-e0d8-4464-bd07-388c4bb476a8", "comment": "Malware payload (RemcosRAT)", "value": "ea2317722ab513e4811d4f45033e1915b7a640ef", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962230, "uuid": "30f4542a-e64c-4b0a-ae6d-1aa509c52d0f", "comment": "Malware payload (RemcosRAT)", "value": "7a273f799dfa7adc186b4f5bac42a91cbc0940ce1f6f6392c76cc162df9224324a21ce255b52352d092f651b03596bd6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962230, "uuid": "711fade0-f554-49a8-9feb-e61a144d41b9", "value": "T118020E0E0D8215A4983574F6E687CA54D712AE6244C3D5E3F62FE9EEBF321C8E321917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962230, "uuid": "bfcf6658-e397-4637-9d06-55486f185c5a", "value": "192:FpB1ax0+AxaUM4w7xHuMt1wx22qWG9GgF+AxuGV2zPnKmdUWnmVR6RTF93XF3CH+:FfZScnKmdvnmuDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783962230, "uuid": "fddc786f-7728-42ec-b466-dd81a02376e5", "value": 8870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783962230, "uuid": "d44e63e4-386c-4feb-af20-c18c6a731d34", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962230, "uuid": "9fb384d6-5a59-490d-9fec-b62cdbb64916", "value": "weneedtogivebestthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b50bf1-7ece-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1783956269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783956269, "uuid": "3d55e614-6433-4953-b06f-6f72de77092c", "comment": "Malware payload (SnakeKeylogger)", "value": "bf43dbd5fae44aa9811d2d9412ddbcee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783956269, "uuid": "c2c94f95-d83f-47a2-b9ed-700ab8110b78", "comment": "Malware payload (SnakeKeylogger)", "value": "889ae5f08236631f13d71877bf20232a09596b0c2b47132a7b3bb32bfba81d60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783956269, "uuid": "7bc0da1b-eaf6-4528-b463-50ae13375046", "comment": "Malware payload (SnakeKeylogger)", "value": "0e83e8d5b8f55eb0a5c5cc5873d0be9f2c04642e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783956269, "uuid": "16da6e86-7600-48aa-8e50-8df4fa56ce9c", "comment": "Malware payload (SnakeKeylogger)", "value": "c24d0706977fe58968366e0d5433971739298b86c450e16fab0fc12a739f230208d0fdbc5e30af3b7fb7137c69e70c95", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783956269, "uuid": "de81b887-e273-4eb4-a1f8-bab3d4e34cc4", "value": "T170B5CF4067C0ADAC47DE5F3AB63FB1E9F2E10CD421815886F721BC84FAA6708DE56674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783956269, "uuid": "553076ec-7bcb-43a8-a063-5d69b9a6f6d6", "value": "24576:oGR8ixIzmbvy22vK4qHJomJDR+l/B/NxkFdsNMAJ2VB2bqpbdz5omJDR+l/B/Nxd:oG4P/nhNTkLauz8hNTkLauza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783956269, "uuid": "320cebf9-ddba-4ceb-a3b3-d56b3b094373", "value": 2283506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783956269, "uuid": "41f77cda-4474-4353-8261-f64093dad1b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783956269, "uuid": "6323fa21-e90b-420d-8a9f-6b8d3bdd51ee", "value": "OSLO EAGLE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a3ffd0-7efe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783976779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976779, "uuid": "08aaf320-bb26-4cf9-8cd8-22cdb761b371", "comment": "Malware payload (Vidar)", "value": "4faa5a640a510a889c794892bd35a8fa", "object_relation": "md5", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976779, "uuid": "e47e08db-b5f2-4893-a837-d78fe5c4bd11", "comment": "Malware payload (Vidar)", "value": "8aa914b8fa0f9cf953f3cd9a9bcbfa27c43a7b7be8ba39d780fb80eaaf3766ff", "object_relation": "sha256", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976779, "uuid": "1dfcd1d1-bbfe-4c5c-9a5d-68e4b1994a0e", "comment": "Malware payload (Vidar)", "value": "acb5bb5a847851b6d4f88dafe877a83aa4b418a0", "object_relation": "sha1", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976779, "uuid": "b9608acd-d488-4e51-9137-5af6eed4e1d8", "comment": "Malware payload (Vidar)", "value": "b87b5a6f759d0d6fdd0915e13f5b3c39e08b3810820c2e540787f395d170486109190332ca5bf485530be2d3a614487d", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976779, "uuid": "7b91fd1c-cedc-47b6-bb32-dbd1b8d069be", "value": "T1F3C73375AB5A110DE74AAF7AE449235DE4F0960ECFB1BD0F9E6810807C923F59F06913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976779, "uuid": "79a048da-e406-4079-ae23-99d83b70931f", "value": "1572864:1QMQNr1kuwU9EknWcgOyy/e5SP6XQGEP9Xc:6MQNrOdUKSWT//5SCXlEPdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783976779, "uuid": "43b71646-32ce-4c97-9985-9919e2839865", "value": 57264082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783976779, "uuid": "ec13d3f5-7cc7-4190-94d7-984a4842aae8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976779, "uuid": "d3d84e12-2603-4f5a-b534-62b0ace57297", "value": "#Pa$$w0rD__2024--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8c8b70-7eb0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783943060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943060, "uuid": "75728f05-20d8-4436-8519-68a3ec9d07a0", "comment": "Malware payload (AgentTesla)", "value": "e57a87dc9ab5bd0bf814434f9579cfff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943060, "uuid": "8db3e6cf-14b9-4876-861a-117fa9bd4bd4", "comment": "Malware payload (AgentTesla)", "value": "8b05e74af9b6c18b31a656b26f3458dbd1bab2527ba6830954978c66c6e219ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943060, "uuid": "a3823b68-cf9b-48ce-b6ef-201c6ada1fc5", "comment": "Malware payload (AgentTesla)", "value": "b4875cd62a35191d2d62b541a1b4e5505b71e0ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943060, "uuid": "566c10da-5cc1-4df8-aeb3-ea48ff4b76ce", "comment": "Malware payload (AgentTesla)", "value": "e5bc31ab7fa8d28dad31caa1b2aa3acee37a550989bea8b29be18b81a7f6ae49189c9f2c0f1652c70d7c3cb684fcb24d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943060, "uuid": "c64b0129-a0d9-4eb2-91d2-a8db8a9df269", "value": "T19C251298A645EA13C9916B7C4DB2F37912B91CEDE900C7175FFE9EFBB8699004D04283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943060, "uuid": "2affb796-fad6-49ad-a9cf-870c6c9ca7e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943060, "uuid": "807d9c1d-9d0e-41f1-b111-aeb4a084b901", "value": "24576:HFRJdbai7/XcsU0jxX0zsEC/WCpjOlAfUtD:/JL/M4Ew+oqlAAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783943060, "uuid": "4b1367b1-53d0-49a0-897d-892d6fd89c5d", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783943060, "uuid": "9a822a0a-1862-46a5-8993-9f0c2c9aad59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943060, "uuid": "58fa0d40-324b-4b3b-bc72-ab61665ca4d3", "value": "10045_2026-07-13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313cd37b-7edb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783961531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961531, "uuid": "e40e7e2e-361a-4cd9-96d3-f6376b52ec03", "comment": "Malware payload (Efimer)", "value": "d0a9bb4ca40e104b5a875286f11a11b4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961531, "uuid": "1ce0d9b9-a5a5-4807-899d-57d80a3559e3", "comment": "Malware payload (Efimer)", "value": "8ba4353f9d3f4087c935b4165e61812cdaa10bbd5d1b43906c24e9712a5cadda", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961531, "uuid": "45df92f6-e3ff-4b41-be07-e91b9137bd3d", "comment": "Malware payload (Efimer)", "value": "0e388ba287033ad310e2258cc4c1f24624d1343c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783961531, "uuid": "93204777-249d-4438-8b8e-038d8d15306b", "comment": "Malware payload (Efimer)", "value": "930e280de3f6dd351cfe03c06fb859bc51cd2dd058a53afd920301dc2e06a7dc928e430f4dbd6a7d6de84c6619f0f94a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961531, "uuid": "1a1dae8c-8bc0-4420-8be6-4f31abebce7b", "value": "T1F5E633486AE002FEED63003DEDA19292E2A974715B71C5EF17DC8B60AE933D05C7DA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961531, "uuid": "626f80ab-9d82-4814-a4a1-b9e4e17a2646", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961531, "uuid": "78baaa0e-95f8-4b03-b9c0-2a9cbe4b0c5a", "value": "393216:9+bNcb3isbPPPIVFqEB1xmXMCHWUjX/cuI3/PGTAI:9+RW3hbXgVnDmXMb8XUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783961531, "uuid": "bcf13939-573f-4c0a-8d4a-65f8693b6762", "value": 14309409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783961531, "uuid": "9362a3c7-9840-4200-a570-ac3fb276b137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783961531, "uuid": "42350447-d42b-43bc-aab3-bd431a19f331", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd60f90-7f15-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783986731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986731, "uuid": "da5b31ae-6ea6-486f-9f8a-3bf96c23170b", "comment": "Malware payload", "value": "9eeb3d4db1dde204249bf0786cb3c342", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986731, "uuid": "d38b3575-b0d1-4145-97ee-1cc4b401fd28", "comment": "Malware payload", "value": "8d0201c41efbe90707b12ba9b0694ea74a1a8e3a4887064ed9eafb62dad6ed7c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986731, "uuid": "b4de7d71-ad1d-4e46-8487-e3b278bc1f8a", "comment": "Malware payload", "value": "5a5d996461b4f2e7916a00c65f4487f8a35cac17", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986731, "uuid": "e9fdde37-374b-4ad8-b4fc-66039401704d", "comment": "Malware payload", "value": "f4f55577cc180d33d92f75acb9937cc0070b7e2ef428b4eeba5ea525742e306c6cc98612516203b2bc6ccf99a6832323", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986731, "uuid": "6c2aea16-63e6-4086-af7d-30c5d69443d5", "value": "T1B4E6330816F023FEEBB3443DD9E116E5D160389617B2CBAF1B90C6E16E571A1AE3C617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986731, "uuid": "321a3dbe-528c-4513-b518-b10a2f5c8d17", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986731, "uuid": "04eed9d3-2a94-4b4a-b935-5d8eeab9a9a5", "value": "393216:1qiWFIzu3ymozwvXMCHWUjXScuI3/PGTAI:1Tzb8vXMb8XvH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783986731, "uuid": "d8f468c4-79df-4278-b33f-a74c3a764157", "value": 14289977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783986731, "uuid": "e21d72f6-5ccf-4fd6-83c8-8e3ab6e3011a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986731, "uuid": "7d74c948-1f11-4007-9bae-358fc32fd582", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7539f1b-7efe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783976761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976761, "uuid": "71ddd6e0-300b-407e-b9c8-d352ed423f3b", "comment": "Malware payload (PureLogsStealer)", "value": "80413e594c109940b980c2b9c0341f89", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976761, "uuid": "f621a968-5580-42de-a701-2342376a1454", "comment": "Malware payload (PureLogsStealer)", "value": "8e97301bed92f00dbd667e65c4e10f7c5d53789eeff64fb067c13a7b66985a48", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976761, "uuid": "4385b1d3-8c41-4fe9-b340-59296773738e", "comment": "Malware payload (PureLogsStealer)", "value": "6a40d6cd9aef9ca7c441d268139666a4da07472d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976761, "uuid": "6c0bedb4-f6b8-4eea-980d-bdd3b167c2bf", "comment": "Malware payload (PureLogsStealer)", "value": "23de977a2d0669f130423ea465fd651e543036a14ff76380ae3f32460e968e5f9f6a6b234a637cb6c681c1bea9dec998", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976761, "uuid": "70ffa1d1-2b0d-4e89-aace-cfd1e1fec94c", "value": "T1D303096EADC0E4125ECEA175489DE9E33AD6CE4C3521B97D786C03E34BA44B73D6260C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976761, "uuid": "b813bbb1-f462-4516-b24f-e51be9228765", "value": "192:f5VKQoMhQMHjMrqUKQFUKxCMBx0W0b0E0Q0y0s0z03u0h0JKQHMGKQjb3MhySKQO:f5joM6MDMpF4MbHM6jzMPjSj4MFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783976761, "uuid": "00c912c6-d4d7-4791-8297-c612039de211", "value": 38518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783976761, "uuid": "49f85286-f48f-4032-bc42-8b993a974b76", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976761, "uuid": "cfcdedff-6903-42fa-ab67-7b85852c089e", "value": "cxx.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9add5102-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963426, "uuid": "d65cf2df-82b7-44a2-b4ba-8ae494d6b89b", "comment": "Malware payload", "value": "49680ab03e532a65e64d7da62be59f4d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963426, "uuid": "fca5521b-71c9-4aec-a1b9-8fa5549d4d9b", "comment": "Malware payload", "value": "926bbc1708cf7e113cc11275236b7be69d02776efbd177a2487b898c1c33fbaf", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963426, "uuid": "9b7a7542-d4d0-4d15-8f15-9d2bb8796f76", "comment": "Malware payload", "value": "4ce57f0f79ed539760c73096b1b52daf8b747aa7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963426, "uuid": "8a7f9f65-8e33-47fd-a6e0-e272aa88c42f", "comment": "Malware payload", "value": "605f206b34b9ca4518982887b670d4a560d9e7902a5ddbff315223fef6f716f36014efa6fd0629581e799435406f5d07", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963426, "uuid": "05aa6679-24ce-40af-9247-6f78501e2bb7", "value": "T128514C040BDD1724D372CD3668FA920244307467EE169F6E4398168E6822614FE36F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963426, "uuid": "2135ce80-5683-4a27-b513-a8328b4e7cc6", "value": "24:8KAFpQQpGsSYbPR4Vok3+f8cy4o0gfb4o0OBq8bM4:87FlSyPR4VT8No5koS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963426, "uuid": "aca974e2-70e7-42d5-91fe-f04200369559", "value": 2490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963426, "uuid": "a1f2bd9a-f961-4e30-9341-885e4d2318bc", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963426, "uuid": "76b68b6e-a7da-4ce4-9c2f-ad944be16e2d", "value": "live.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b901700-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963186, "uuid": "503eac3d-e324-4b16-910e-f14c27e32754", "comment": "Malware payload (RemcosRAT)", "value": "251e6cbeb0e0979567c21cd49d4b2174", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963186, "uuid": "5ea2fc16-cdb4-4615-9375-3077d0bbb454", "comment": "Malware payload (RemcosRAT)", "value": "9324f7e0d0fd5eb9926994d04e5c195f9007b963339356acf5690a4a9375763e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963186, "uuid": "75feb141-455f-4ce8-9f3d-4ba32e7f327f", "comment": "Malware payload (RemcosRAT)", "value": "8d3970b2347f017999f4c58e336b6075bd54320b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963186, "uuid": "79077607-dc5e-444e-9736-db5572a13a18", "comment": "Malware payload (RemcosRAT)", "value": "374922c3ec6616cb27748186912f4ad09d7b0c93e929a93e2091b1ba34c97860961dbeae476f6548a34b1d1132044921", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963186, "uuid": "f0da20ab-65c3-4823-b2bb-83464b61a73a", "value": "T1D3F423157691DA8BD527403E2DE688AB001CFDC40F09E62F3065B34E2B7DBB991D4BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963186, "uuid": "b0a05e54-d527-44ff-b870-c5b6fede60a2", "value": "12288:K+325ELxhCEheBl6tXWjr6/CXBFEn+SOKBjqw6Nfqq52BaJcvt9oyd/ifMX:KNCL7C8zX66/KE+SOm+9Rqk2shyd/ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963186, "uuid": "ff57b86b-eb07-4ed1-ac59-3ebe32e88b73", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963186, "uuid": "1a1f4bc5-8745-4c76-b958-9a8dfaff952c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963186, "uuid": "447737c4-51aa-46a2-99d3-ca8a4746796a", "value": "PO-104-2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3893d7-7eb1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783943623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943623, "uuid": "e93bbdb2-39e7-4d33-b811-06863622fcc9", "comment": "Malware payload (Mirai)", "value": "ac17f627111ebb79de60e0b937896d05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943623, "uuid": "ed7a874c-3cfd-40f5-8926-41cd3e7c70d9", "comment": "Malware payload (Mirai)", "value": "9330b1ba6efc8ad5c8e40caaa42c0225d63df40b0a67593d1601d17357b25441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943623, "uuid": "ba1fcaba-8094-4600-b30e-dc91195dae18", "comment": "Malware payload (Mirai)", "value": "ba2aef8334d07cefa080c459cefcfc0a50e1f34d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943623, "uuid": "e788aa6f-d41b-4953-b43b-f3a81a8ac503", "comment": "Malware payload (Mirai)", "value": "67a79bd7467089ef9c1d9306273235df7499ca3e260f597e1b1a0562b488d554dfe6ae34ef3816a828db2f7ca5c171c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943623, "uuid": "6d28aff5-5371-496a-a2c6-aac180b8a80b", "value": "T165B30789B8D29A22C6C316BFFA5F429D773663E8D3DF7107DD156B21328741B0E6A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943623, "uuid": "7431ec31-51a0-4da4-b140-ff6b689c6ea5", "value": "3072:lYTnpg2BdR84p1ciU5OW+69ldDEBNVAnbo:lYTnNXL1ciol9lyNuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783943623, "uuid": "0eb9458f-97c6-43d6-b375-8b82450bc501", "value": 116084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783943623, "uuid": "a6ff0dd6-85bc-41b8-b3cc-44fa85454d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943623, "uuid": "4b99f3a5-7963-40db-888e-52e6250d315d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52bb043-7ea8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1783939928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939928, "uuid": "c02a0b7f-978c-4112-96a0-8833f4d8a7d7", "comment": "Malware payload (GCleaner)", "value": "9449a051bb8d647541dd980b998baabd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939928, "uuid": "ca4090e6-c6e5-4ef9-bcac-e1d42041e4ef", "comment": "Malware payload (GCleaner)", "value": "937c16c2f853b605c2be68982a65109fcd5f2cdf704b9438cd254a38ff529b7f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939928, "uuid": "a6ede902-4c8d-46fd-8e4c-7829777a90f4", "comment": "Malware payload (GCleaner)", "value": "83dd3427c1f594f93bdec864dca1a59377259012", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939928, "uuid": "e209f2eb-2477-4fce-95ff-dc2716a22655", "comment": "Malware payload (GCleaner)", "value": "ac33284e721832f7f5d872da2a8f5d8504666e36504c54289c52895ad5ffc783853f2beb76108f7c00ffaf9affd27b2a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939928, "uuid": "98363fbd-5ed6-49cc-8438-0efe7ac9869f", "value": "T1FA357C26B2D1D837C4720D7C9D5EF2D858747E105E2CA44A7AE44F4C3EBAE823A25367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939928, "uuid": "7b2d6faf-fa5e-4681-8707-ec1d6e957d1a", "value": "a6d13fdb0da371c46439f70f103fd961", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939928, "uuid": "eebb3f6a-7564-41f2-903f-9f5b50e8f3b5", "value": "12288:BW3+mKqp6j3vwpzTcNGaHNY6CEaQfCHAHG+XACxx0AtVgBOf0JYxtAT4zRnPzXTC:I3sE6bAzTcpHusOexH1Nqf/vk9J1ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783939928, "uuid": "c37b056b-62d9-425c-83db-97bc49430e30", "value": 1135376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783939928, "uuid": "aa971467-4121-486f-aadc-eaac570557b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939928, "uuid": "8b2ad34f-756d-4928-aa16-27218e28e98d", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bdac87-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783906234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906234, "uuid": "358c9ba3-9e67-422f-bb41-a3aff453fd55", "comment": "Malware payload (Stealc)", "value": "dec016af4c8c7dd141216663e16e56fa", "object_relation": "md5", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906234, "uuid": "94123b5a-44f4-4456-a2bd-7d02fb8f5bc7", "comment": "Malware payload (Stealc)", "value": "957c3fc02297170cea63f95c640c63954774ed5b25be4bb9f40f14b9aba1e06b", "object_relation": "sha256", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906234, "uuid": "d400958b-1c6c-464a-b5dc-a507b9d4c9ef", "comment": "Malware payload (Stealc)", "value": "3cea4a0aa7fcc6193454722609d811f62574f017", "object_relation": "sha1", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906234, "uuid": "fd611a63-b3e9-45e9-a9ee-60cb2168c37a", "comment": "Malware payload (Stealc)", "value": "e548eaf17c77dbd61d4a6f01919089e5029d5fa4242e62dd02a171fbc17b38399a3e2d05e024d9aade7b573128337e1d", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906234, "uuid": "517cbcd7-0fb7-40c1-8b5c-12fad8ed46f6", "value": "T131328A3CD6B1EDC4036F31D09A5A3F4620AD5B23F7B44B6CF9C148AA1868658DF3A19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906234, "uuid": "758b19cd-c769-4c03-9f29-5356e244ab11", "value": "192:PY6uua9ArZzjPamI2/lu6tCAgBQn+9lN+pLSlyZoZwh7LHYua629C4LW4cuOmX8x:wDua9ArZ/Pah2/M6MAgB0+9L+5SaThXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906234, "uuid": "b9e71037-e4f6-4370-b47f-ce11c1aa1091", "value": 11022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906234, "uuid": "cda0c2b1-5018-4cf5-8903-1a0071a211c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906234, "uuid": "e8d494da-c30a-489a-90d4-3ab16071dee1", "value": "2gnqD3iF9lpo4CzmS.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24679acb-7e98-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783932733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783932733, "uuid": "cf547477-6127-4f3c-93c5-59f6e841b922", "comment": "Malware payload (Efimer)", "value": "879ad6297b69d8265245cc370e7c0d05", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783932733, "uuid": "15a94dd5-ce42-4fc3-b616-b71b3e593da2", "comment": "Malware payload (Efimer)", "value": "9587e8422655a68369d7b00e521b7d1cd3b32e57b624c253526a9b0e094f33fc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783932733, "uuid": "cc4a13ec-d8f6-4386-830c-966bdf3ecbd9", "comment": "Malware payload (Efimer)", "value": "c07235fe29987131be0d3640164d9c720094c7c0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783932733, "uuid": "80fc8c5e-fd67-4c00-ad23-fc787b639274", "comment": "Malware payload (Efimer)", "value": "73cd18e9bf875969f5139a97578bdcdb6fbe7efb6adcf036b54cda9f69316b4208b740a7c6cd1439f407705344c034f1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783932733, "uuid": "e96b26d3-ce62-4ff5-bf7e-207be8ee751b", "value": "T168E63318AAD423FFEAF7403CDEB116D5E56A7CB50BB2C6CF476842A25D532D08934326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783932733, "uuid": "f422c0d9-ed43-4d17-bc3e-fb88a28b1a72", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783932733, "uuid": "31f66676-02bd-4054-b8c4-ca24c4aaca62", "value": "393216:ufWIEJGHDad7fB5RHR61F4AXMCHWUjX1cuI3/PGTAI:uXGN5FR6XFXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783932733, "uuid": "475a3e81-14a3-41b4-b926-c656a46cfc3d", "value": 14294620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783932733, "uuid": "4da4d11c-4b69-4487-850b-6677c1f0c915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783932733, "uuid": "8e419ead-45c4-4109-8984-dc1f064275e0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c83a6d6-7f0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783982676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783982676, "uuid": "69c2c5e6-c8bd-4d47-adef-3c97f49e670a", "comment": "Malware payload (Mirai)", "value": "67303ac025d6465b544cd4fb5dd65b35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783982676, "uuid": "3730f6d3-ba1f-4de5-95fb-8d83329c46a0", "comment": "Malware payload (Mirai)", "value": "95f08187d0a5572a0b2efba21b0dae6155d7a1b4a4b17034c768b2fbe920626e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783982676, "uuid": "3eff5310-333d-4f46-9b68-a478fbb0e0b4", "comment": "Malware payload (Mirai)", "value": "03a43e57d8820b5c9da2e87cf8bd937ba682ed85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783982676, "uuid": "9689a950-36c6-4cca-9a2b-28e335a05029", "comment": "Malware payload (Mirai)", "value": "bc525e694b55ce99285e77ce9d1be223d3516b006349ecb77465b6e5cdd41836ee26e68eafe33226db1ce26d827dfda1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783982676, "uuid": "6856056b-902d-45eb-948c-3d3296be4fbf", "value": "T151838D68AA0F6D81C2C7E3BEBD560FB271333CB48364C1B26A01E65DD8E9EC48D95157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783982676, "uuid": "a49d78b6-c83b-4fa9-a551-aefd464ac369", "value": "1536:XTBEk/gqHdJedilmIWxYY/3zIExThFd1/rnE8KOC54L6CjIr:jBEsdJFqbjIE5hFd1rE8KhRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783982676, "uuid": "162530c2-5b36-4b05-8215-e7d25108d1ee", "value": 83384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783982676, "uuid": "603d63b7-dd53-414c-b5c2-3c644af1bcbe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783982676, "uuid": "83323487-e116-41fd-be5a-1e221d95ac45", "value": "SecuriteInfo.com.ELF.Mirai-DJO.89223942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c19d83-7e91-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783930054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783930054, "uuid": "fec406cc-395e-457f-bdb2-87bf7b30c7c9", "comment": "Malware payload (AgentTesla)", "value": "4c15e615131b40209c735585d1130bbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783930054, "uuid": "51696632-7609-4dc3-a8d0-276ae04b9ef2", "comment": "Malware payload (AgentTesla)", "value": "98287949544f5d5e814f0febc7e87f3085a24405c3f193f60514d7231ea19bce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783930054, "uuid": "f1b4a76a-2542-418e-b17c-aefca915c9c1", "comment": "Malware payload (AgentTesla)", "value": "0e08fe8325df2762d88eb2550f204a399ce779e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783930054, "uuid": "313c59a3-d4eb-484f-9c1c-81c42028819a", "comment": "Malware payload (AgentTesla)", "value": "34dda3cd00aa95a8975c033e34dd6fa153329c04dd4672cfbd83f747e1084703d58be71dd02b769d6f542a2089ddf080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783930054, "uuid": "4f002663-282e-4c44-8135-88ed867e31c9", "value": "T171643870DA20027B4F87BB98BCA50660C66DD325852705F0FAD98B0D910E9ECF77D66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783930054, "uuid": "af9e1c8a-a33c-4e57-9160-4a93ea6d63d1", "value": "6144:AZ2vrijGS3o7mHJFMoSugX+1m7CPy15LYCssCQrHH95lr:GWriaS3HHJS/uU+1MCPyv0CsVQBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783930054, "uuid": "ec692cdb-963d-42c1-941d-31f58c2566e1", "value": 319315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783930054, "uuid": "542e0228-f1ad-42bd-9996-d1447a0b7217", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783930054, "uuid": "5758d192-1826-4ce1-902f-0cb3b39a27d4", "value": "RPF1910485_20260713.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f69eb2-7e4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1783901512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901512, "uuid": "b5cb1135-0b59-4c91-840c-7680350c67fe", "comment": "Malware payload (ZigClipper)", "value": "80588ad7bcc4c92c0b9e005178cf8414", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901512, "uuid": "3e67d048-a51d-456e-9253-4c7d470c3245", "comment": "Malware payload (ZigClipper)", "value": "99dc1ea286648ec882d71ab5071e3072c702e5170770843177807179c63f4593", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901512, "uuid": "6b4a667a-8a82-43e8-bfe1-453e48f3d625", "comment": "Malware payload (ZigClipper)", "value": "8caf6a3d3175bb375650179e74ec405169f7fb27", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901512, "uuid": "cbb5c2a5-2aac-47e2-9e50-4af1cf43490f", "comment": "Malware payload (ZigClipper)", "value": "03ede0f4fe3eba48f783bca725f2830570ef39ac8d7ebe4b8cd49fe0f7161b38126d3e3acba7092feaece74475e9cdf6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901512, "uuid": "b9df4338-c270-4b77-8764-c84ee559a6e3", "value": "T19B06011DE38D52E8D213D134CBA65232EBB4B85A0761B9EB165EC7192FB79D01F3A310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901512, "uuid": "32c63fee-1d62-4620-ade5-c02c9a9aec27", "value": "d7a140ad86093e229082e6f8b7493b94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901512, "uuid": "66ef3b3e-e834-40f1-a72a-ad2bcd442d10", "value": "49152:K6K1K+gBUcOSrSCVb6KbS7RWxHzwiIH5NZSV4P0coLPdAptvDy1d+HzKbC6Hsq1q:huQzG0YQVA0/LPmry1dhLTjUCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783901512, "uuid": "a0fa16ee-b8f3-43d6-8783-41e81dff1db6", "value": 3890176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783901512, "uuid": "91ee8d53-5644-467a-8aab-aab5c2b46cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901512, "uuid": "20ec6147-35cb-4dea-ab73-b832bac11634", "value": "zira-miszsn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c0441e-7eeb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783968729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968729, "uuid": "616f3821-9f49-475c-a4d1-c522b2ee03b9", "comment": "Malware payload (Efimer)", "value": "506b8b08b9043d3be86a8f4793a2feb5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968729, "uuid": "449deab6-b586-4b44-971b-5e11fdb8bf0b", "comment": "Malware payload (Efimer)", "value": "9b9f01a45caf0aa8968ae28849b1034616dbd3f578a01fa2ecab926be9c1a5d8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968729, "uuid": "84f460c2-698c-4d8e-be14-21716c933c4c", "comment": "Malware payload (Efimer)", "value": "08f0e4b3560a94939d9d1696096aa3e5f2fcd9d2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968729, "uuid": "ae3b6e5a-d706-4421-85ac-8b78ff4d2322", "comment": "Malware payload (Efimer)", "value": "065618bbdf81e0ff0a62ad88d41cefba50d2e05c751b50472c417228c8d19b5fed64d9a31e480206c8f155f7d5b9aa23", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968729, "uuid": "3f5d63da-eb83-4b7c-9cdd-6ab52b76a13e", "value": "T1E3E633082AD005FEE4B3517DF9A28162D6B478BA47B2C5CF1F84C259BD071E14E3E6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968729, "uuid": "43443d84-440a-4b3a-9a25-cf3afd6c27cc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968729, "uuid": "efdf84a2-db3d-4d82-bb20-fb6f6a8ff51a", "value": "393216:OKrO5v2ECmoSTL2PEhmSoHhU3poV7Bwm9kuIXMCHWUjXXcuI3/PGTAI:OKMrivPNhUZoFBwwIXMb8XsH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783968729, "uuid": "de173f56-35fd-4166-adb2-8c5425e14c67", "value": 14323776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783968729, "uuid": "befca20d-a939-4ff8-b6e7-8b3c981006ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968729, "uuid": "664665fa-aec9-4d9f-8ae6-69c2b946b039", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c83a137-7ead-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783941954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941954, "uuid": "1a0d4a6a-52a2-4946-9bc4-848b1a82736f", "comment": "Malware payload (Mirai)", "value": "0f0df5c05c668cf7b61653be36f01264", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941954, "uuid": "099a45be-7166-4588-87bb-46e80147de76", "comment": "Malware payload (Mirai)", "value": "9c696eb71f19694cdbba03348de87edceb3af6990b8ee91ad18b1854ed91bdf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941954, "uuid": "f281fcff-e96e-4b2c-b977-f29b585ca429", "comment": "Malware payload (Mirai)", "value": "a3545727ce1b913d0c62ef45170e4c529256b6a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941954, "uuid": "88c90d65-55af-4ef9-9ba1-6f33fc905422", "comment": "Malware payload (Mirai)", "value": "644a9cd3f6135ff9bc05d6b4aa1f04a98ca278460cb3a928d6ef8e04d466d305ce03fc6a261f9818da3b4396cf56537e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941954, "uuid": "c96f5444-e3f3-4196-9aa9-b9b6e0cce85f", "value": "T152E3C50E6E394F2DF37A8335C7F74A25AB5572C226D0CA49D27CF9121E2024D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941954, "uuid": "1556d5a0-0c53-41dd-a576-63c3e714df3d", "value": "3072:i7ld792OydT726syoZxRQhZkzTdSALp6NSdIXBgYuf8hW728lVSAq6glm65vPNPh:Uld792OKdAzkv5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783941954, "uuid": "a6f0b816-1f5d-45d3-96f6-854ecc22399f", "value": 155228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783941954, "uuid": "f39b8f63-655f-43a8-bd77-6ef3f7a3a7ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941954, "uuid": "e9edd45b-7d1a-4e5f-b136-fcbafaa00180", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66773ff6-7f03-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783978800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978800, "uuid": "4fbbc976-fa1a-48df-bb1c-3543389f14d6", "comment": "Malware payload", "value": "f620444361bddbb7e881822996a4b2c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978800, "uuid": "997e8638-e926-4e1f-b168-3aebbbb4e5c0", "comment": "Malware payload", "value": "9d4a3ef6fa7b16b9d9646c3db7ad08e465797a9fbf1f6abde0708cf06b1181fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978800, "uuid": "8ee0be25-23fa-40e5-825b-10e99e8f41e2", "comment": "Malware payload", "value": "fb1a78bbed8716a73590358943619396f7281ee4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978800, "uuid": "5239048b-4079-47d1-ac25-1809fd533b96", "comment": "Malware payload", "value": "45c8963e403b2e079b7552b0b05ef0b6025e61081f9e8c58bb4c580c94092258cd8c37a3a1f478df3218dff9b6dd25b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978800, "uuid": "d9efd927-6c7a-49ea-9a61-0b400b807fb9", "value": "T1F4649E13BB878FA6E121B67549F3C178A9E93A0606F7C426C3796B17079D1C0B81DEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978800, "uuid": "d69e8090-7d94-4956-8073-3cc8880e9538", "value": "6144:g+eQOF9sIrei9VoG5bYREEBQ6QnIJWJaoVz6zMwTGe:g+eQOzFrVVPbYGEBVWJao96zMwqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783978800, "uuid": "159a9cfb-bd93-4283-8ad7-fbd4cee553d9", "value": 327472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783978800, "uuid": "76d9942a-6c05-4e12-8635-791026d0db06", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978800, "uuid": "2ff88cda-bcc7-426c-a854-953bb3505faf", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff9151c-7ead-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783941718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941718, "uuid": "b8cc88c5-6744-4639-9772-de69d010644b", "comment": "Malware payload (SilentNet)", "value": "d779e1d3b8912a01314be879a001a512", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941718, "uuid": "76a73920-77a0-4fa5-b132-70ecdffa5aa9", "comment": "Malware payload (SilentNet)", "value": "9ff20a22a56a1ded50adea1d1f1db258765fd8b9a9e77467729828398780c9be", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941718, "uuid": "caf18bec-b866-429c-8e11-11b3fc8b02d3", "comment": "Malware payload (SilentNet)", "value": "1ca2e22a5f6638a2ce2d2a90c1257d6b294e65aa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941718, "uuid": "e06029dd-c51f-437d-b037-051b502593b5", "comment": "Malware payload (SilentNet)", "value": "1e1420e5ed135cd97e03407c5d3d68ecd03d9f3fe30c021fc0a68aa0694b71cf50c4e6d69f8dfa6838627d6ec49e0294", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941718, "uuid": "9c1e4c9e-9707-4028-8abb-534bc0ed4168", "value": "T12F463324D9BD267DD1632730D8860E2B3B4E23C4AD017E2F1FB418BA4D476C56F85BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941718, "uuid": "08f88340-a97b-410a-84f0-47e9e672244e", "value": "98304:RkX66PQGWc8IQYrc16j5E0iG8oEiUyxtka0iyLmH800Dx+KyksqYaP:O6SQ/+QR16j5E0bhDDU680S8KMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783941718, "uuid": "69827130-e8f6-4b84-9b96-e05ff932cdc6", "value": 5659227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783941718, "uuid": "d5ebdd73-8f2d-42f4-8e32-e40ac09f6803", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941718, "uuid": "22b6ba51-e56d-4d00-bfb2-063ed8486846", "value": "Krypton Cracked 1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449c3de8-7eb4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783944813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944813, "uuid": "df7ddd2b-74c7-4dcd-b60d-71cb2cc2686f", "comment": "Malware payload", "value": "e4389a12a813e308d2054460446f3671", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944813, "uuid": "afea91d8-7db6-4f53-bec3-4ec038f51e8d", "comment": "Malware payload", "value": "a11dbe60a14a69718b2fa4311239e2385c10bd3bce45213c5f40ea365503cedf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944813, "uuid": "ddd3aa2f-9e92-4c75-8cff-d80a96f0204f", "comment": "Malware payload", "value": "a0ec3b24f3711ef068530039e53c99fb421015aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944813, "uuid": "affc872c-a645-4946-bcd6-de47332cce99", "comment": "Malware payload", "value": "3cc90b339180bb6301f37e474f9ca2d57eb2aec8b99f5651e5597e811f7f057318097a55ffd7c53b7b45dc47a025f416", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944813, "uuid": "0042cc30-95a0-4835-864e-44d215feebad", "value": "T16BD214F1F8EC9835369D453AB79DA805A9DF7C2F4DA77D2014235A38421CB0EA119B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944813, "uuid": "c22002b4-6bbc-40f1-ad9e-3cac74934d06", "value": "384:jV97Iipud3s1hiuu7isjsKG6q/A4UADAZdhQuW57:3IipQshiulUMdUAkz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783944813, "uuid": "ddb11abb-7e04-44c3-9961-9d80a2a17643", "value": 29000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783944813, "uuid": "09df2072-a35c-4b72-8b10-3bc68f8c4c0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944813, "uuid": "b0dde377-9ae4-4a48-a9de-50dc8d4b4a50", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2967c9b2-7e90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783929306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929306, "uuid": "b64916cd-e697-4a28-a206-9ac29a505fad", "comment": "Malware payload (Mirai)", "value": "ac356a85ee55a318c4f9194828b03b70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929306, "uuid": "535bfe22-c597-4f61-b780-16db769fbce9", "comment": "Malware payload (Mirai)", "value": "a27e6dcbab42574b8953dcb508ee0e66cbb16836b11b89326e211a3e1c06cc1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929306, "uuid": "0cbc66c1-f530-4f0b-93a3-00388df2164c", "comment": "Malware payload (Mirai)", "value": "b890329b06294e3c418c89571cf3f796c799ba0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929306, "uuid": "d4df69f4-32fd-49fb-8e41-191b71734725", "comment": "Malware payload (Mirai)", "value": "c89dbdda9be45e50330b0645a2b157a00e45dcab79766b12f756325ca6c0661e33ce681f5db9c82fc2390b689644a2b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929306, "uuid": "e883fa6d-e559-480a-847c-a68dcc144403", "value": "T1C3C31859BC929A22C6C316BFFA5F42CD373663E4D3DF7107DD146B24368A52A0E2B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929306, "uuid": "630b59e9-3000-4724-99d0-8869823babad", "value": "3072:JCSA6DtZxpWTMBWCulciU5IseqmPgU99PZYviTOnblIP:JCS11ITUUlcioIcVU91SviulI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783929306, "uuid": "880f048a-6e1d-4231-911b-6f12ec54e30b", "value": 129524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783929306, "uuid": "b3b57be3-3bf1-413f-aea1-bdd51f91089c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929306, "uuid": "6050e687-e691-474d-8de6-5dd1a4ceac48", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8126d526-7e7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783920863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783920863, "uuid": "ab03ea80-d193-4387-93cf-b21dc7a212c9", "comment": "Malware payload", "value": "ed40f25050abdb06e87261fd6e63a1fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783920863, "uuid": "28558dde-340a-4448-921c-017b23837602", "comment": "Malware payload", "value": "a2c832f061e7e92a22b9a09c0df7558a3ce7e4d95083d8b1530a6350223950d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783920863, "uuid": "41d32c74-b580-4963-91bf-c3ce7b960ea9", "comment": "Malware payload", "value": "c97582f460785df5e3b5ac133de774a2e863668e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783920863, "uuid": "5de208a6-2cb7-4311-ad45-7d8f0fd8df77", "comment": "Malware payload", "value": "c56167f7570f762e3c4f3e26a65cecafef9955f179baaf0c972c254016ee6d0db01a26007579c9b70a91fc9c1a390a30", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783920863, "uuid": "f4a222a0-d21e-4321-9dc7-fb987295c768", "value": "T143C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783920863, "uuid": "3e5f6b37-319e-4324-883a-0695961190e4", "value": "768:p8vCB+25j6es8Rj29FYpMSUpi+20qUpi+20YQX:p8l25J0d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783920863, "uuid": "4be281ff-2cd9-4c8f-a657-e33127f669f9", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783920863, "uuid": "47e337ba-dc27-47a3-9f97-66c9be83212e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783920863, "uuid": "f2741a0e-d5ff-46a1-a987-9109edf88b9d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a86143-7ead-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783942015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942015, "uuid": "566ce8d8-644e-4bc1-8e83-97e864015b74", "comment": "Malware payload (Mirai)", "value": "33691cf3670e6a22ba3b91681d52b75f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942015, "uuid": "896d471d-6295-4247-aad3-749c1b7099a2", "comment": "Malware payload (Mirai)", "value": "a339db9dbd6857c951be822bbfbbfd765747ad12cdf17ce184b5dadb9b44bf16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942015, "uuid": "cd148c82-e92b-4552-a7f8-1e656815554e", "comment": "Malware payload (Mirai)", "value": "402f8e1dc23b26ef43fb6f9d1437500738fa99fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942015, "uuid": "b472d2df-1afd-4943-bdde-2d2158111d2b", "comment": "Malware payload (Mirai)", "value": "bf57cc62bef89ff83945ff9749ec572806cfe6fd186d9910b4bc1e35a5232f3a0e8645e9f098c27b763f6b15a5253394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942015, "uuid": "1012ca27-cbb0-4a47-936c-bc2154d74b10", "value": "T19ED38E9C8E1E7DD2C2C2F2BE6D450F66312675B44964C3F6190062CEEB9EED69CB1432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942015, "uuid": "e7b72439-9527-42ed-a77b-d7d9286ec3da", "value": "3072:JQyqGL09w4z9EjeVu5fUtPNKhceypAaTna0MWcvlc9ECKhR2Mb:SnJCoOXyNK+8a+02vlc9vKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783942015, "uuid": "51d03885-9c2e-45b9-bea9-53ceef90312d", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783942015, "uuid": "6ab3bce5-24d6-4b39-9b97-1dcc4c3381c9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942015, "uuid": "d263f16f-9fb3-431b-936b-2319ee13f9fd", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b84362a-7f16-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783986915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986915, "uuid": "369c2e52-6f40-4051-bc9e-bfb98a7ef504", "comment": "Malware payload", "value": "bb308b3e5ba96755d751acde50928fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986915, "uuid": "28d71723-0c08-4afb-b0b7-f578f033d2e5", "comment": "Malware payload", "value": "a395a7b8c501b4795ef03fcdcce4fb5192e67c8f2a9685dd817997c155fbedfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986915, "uuid": "667e7809-605c-40d4-8fdf-7954c4000b78", "comment": "Malware payload", "value": "a9c3ef51b440fc7685096a59a63e761929d5f9f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986915, "uuid": "ed96ede6-ebc0-453c-8d5f-b1f850a73da8", "comment": "Malware payload", "value": "1e5ee4397a10d0006e716d411019241810b4a266b95195e335e95d8ce212a62b4dcc6e5d686d79e2ba848c869d823a8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986915, "uuid": "a1779905-a78f-4b15-a952-599f6aa2f146", "value": "T17FA3023A035574E2C2EFADF2455E87979E452E65FAEED528F108CBB0780284B2C3A053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986915, "uuid": "2626e76e-5632-4dfa-90e1-0ad29b96e469", "value": "3072:lx/A0+j0u+SFsF38yEbffI3fD1Hhrd7upTdjtMOK+:lxf+jaQk38BfqfDxTGTdjGOK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783986915, "uuid": "4382de62-16ca-40d2-bb47-f71c7550aed2", "value": 104424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783986915, "uuid": "f639e0c0-b7b8-4ad2-acde-08f2524352f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986915, "uuid": "89084864-8627-4423-8112-4e4fc3731026", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55d85f4-7eaf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783942908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942908, "uuid": "22245221-a432-43f7-8995-4480a4a1a163", "comment": "Malware payload (Mirai)", "value": "9f88ac7b05813adde353cd8e2c56adc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942908, "uuid": "4cfc91f7-11c9-4432-8cf9-fb8367d3082c", "comment": "Malware payload (Mirai)", "value": "a5b748ee817860809d48c0f2d749e12b9eb53e909361f37e5cd8469039939d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942908, "uuid": "fabac7b8-06f7-4c45-aebf-279080ca3f4f", "comment": "Malware payload (Mirai)", "value": "8540509f0355205cbd7ca2598f128f081d441180", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942908, "uuid": "8e88735f-80f5-4ff7-9937-d40fc72b5d7f", "comment": "Malware payload (Mirai)", "value": "a1c19502460ab45c1d590dd3c40911c9c8797b57d746a804d211e2a65a2af5c1062481dbf9b956d57e49a2a857b2159a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942908, "uuid": "ecdf21c7-6a1b-428d-bffd-b39bfde403b6", "value": "T112D3078AF8819F21D4D622BEFA4F518D332367E8E3EE7112DD245B2477CA55B0A7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942908, "uuid": "f1c066bc-a1f9-4989-a3ad-8a298fbfd8dc", "value": "3072:hK2/Fqi5oiXyis/k2J23RX4uCbb3z8CquaaVGeQ6mh+OUXCKumKHtf6/nbWH:hK2/FPoiiis8diuA3BvaaVGeQ6mAOUS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783942908, "uuid": "aac2f664-7716-4337-ba52-b1df8426ccec", "value": 138648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783942908, "uuid": "a52a64f9-6321-4e96-acbf-265c86bc61f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942908, "uuid": "b40dc606-9199-45ab-9a7b-e556a0e2537e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba978197-7ee0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963909, "uuid": "c683d9ea-fe2c-478d-9eff-5648a05366ae", "comment": "Malware payload", "value": "dd49124209b3a565a9d11691261387e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963909, "uuid": "e7d5a230-8ce9-4ddb-b048-449cf7503cd6", "comment": "Malware payload", "value": "a656fb2a88ecd954c6792ea41bb81f26463d9ee9eeea64d8f4bfe04060fc6bc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963909, "uuid": "4b8a3a87-5608-4a2d-a28e-1fbe86b81c62", "comment": "Malware payload", "value": "9b02b78a7e34e548185f2cf7f663f2afe42cb679", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963909, "uuid": "4f510ed9-93fb-411c-b165-c752a1d25f94", "comment": "Malware payload", "value": "4d8bc859c1999bb4ae2e5b2ec3ece29bfb21c71146fa42c30dda15b562d761bb4f33a6403890fd6391ddc0eccfe877c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963909, "uuid": "5a8e9ce8-c0c8-4c78-9681-dfa41b839f10", "value": "T14AA31241D1F919839AA208B7D6EEC4EA32CEE77883ABF1674E51CF5117990701AFCC21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963909, "uuid": "3b66dcb1-5885-4341-8c0d-cb0e92838eeb", "value": "3072:u7HhElsv9R/ignS0I3Z9+X5L3QJu3S2QL5/4ivk:udElu7dS0QrAFQLldvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963909, "uuid": "8e4f33a7-3dbf-4c19-bede-1af0fc59bb01", "value": 103336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963909, "uuid": "10b0bbdb-31d7-424c-adc9-639d7eac3c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963909, "uuid": "b22deccb-17ae-41df-befc-dc609d281c5d", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ea840c-7e73-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783916786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783916786, "uuid": "b5ef8bb0-93a4-4051-9877-ebbdb748352c", "comment": "Malware payload (Prometei)", "value": "fcb8375a52916837afc2b81bc88a4133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783916786, "uuid": "1b4a6f16-5bb2-4d92-8a8e-fce118843cad", "comment": "Malware payload (Prometei)", "value": "a87b3c39d9356009477129f7228d393f121cfc78f94e564766201b7e70c8e94c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783916786, "uuid": "da9ffa42-20ad-4681-b919-5b3be62c406b", "comment": "Malware payload (Prometei)", "value": "f5237a5a3710f1f22b14d919b710972d4d18f909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783916786, "uuid": "13cf589b-b247-4bed-a80a-a47ec6578b14", "comment": "Malware payload (Prometei)", "value": "7ca2bf09c17dc5c82c813ebb2e13d95bb3956f3e813f381cfeb170c4efdbd65a13b20caded974ca6e6fbcc3b9fc54ac0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783916786, "uuid": "9fa9a4ef-6ea4-4940-9350-f3f05bc62ce2", "value": "T1849423FBD6C0430FCF16117C277A6A22D2C6553539ED6AB0C62CF8AE0E792075944EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783916786, "uuid": "cedb14f0-3216-4926-af85-ab9a44624924", "value": "12288:4h/taqLkdfH8ytYiflIw0BEmWVeygFurhCB:4YdkVLwKvyaJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783916786, "uuid": "b13d6846-ac4d-41dc-a342-3194c5dafeec", "value": 436276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783916786, "uuid": "3b6d523f-3a02-41df-9a38-713e201c56be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783916786, "uuid": "a68d4c84-bbb9-439d-9648-7b546029e651", "value": "a87b3c39d9356009477129f7228d393f121cfc78f94e564766201b7e70c8e94c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e34cedf-7f05-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783979511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783979511, "uuid": "3f218660-c70b-4f68-bbbe-4b947ef57e44", "comment": "Malware payload", "value": "655e402302522f78f1264785f7f0b37b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783979511, "uuid": "b7538f76-cd1f-49ef-82b2-b839bb4ffb80", "comment": "Malware payload", "value": "a8c5a790eb2df505f426a9a5ac165e720d2a5e2e1b57538aab7b6b89824af7c2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783979511, "uuid": "572cc9dc-847d-419b-b20e-1d283fb20fc1", "comment": "Malware payload", "value": "9119b5709911d28f77c7e423a899455eef9ae506", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783979511, "uuid": "6a32b622-37a6-4094-8cd8-ecae77c1d91f", "comment": "Malware payload", "value": "b250dc9eeacd0ead698c2d0452f5dfc4834c43fbd1f73bbe1426d14cb9a516af15b37ad5308a3fd3b6dec822912e1a5a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783979511, "uuid": "bb20aef1-3168-47c9-8348-c401daf79c7d", "value": "T12CE6332879D006FEF6B3503CDEF08686E56570B90B32C9EB17A88B91ED471E0493975B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783979511, "uuid": "a19f85c0-dde7-4788-8503-c92b64a1785c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783979511, "uuid": "3352db4e-aefe-4787-840a-42131059f707", "value": "393216:u3jfoeWzJqSsmm9BSXMCHWUjXocuI3/PGTAI:ujy9qq1XMb8XdH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783979511, "uuid": "bb1317b6-e73c-4e2a-b9cf-dcf8efc0fde9", "value": 14314246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783979511, "uuid": "62a3f568-3e9e-46ed-82ae-e3db69e17d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783979511, "uuid": "584e6fef-9a8b-4f0e-9154-9cd7d071a8fc", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2b8f92-7e61-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783909364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783909364, "uuid": "45d8ebad-fbc0-43ed-a8be-700e23636162", "comment": "Malware payload (AsyncRAT)", "value": "e243eebb350f2a6a46e92fbf60f6630a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783909364, "uuid": "dafe388b-f83b-48a0-88a1-3522ed9e702a", "comment": "Malware payload (AsyncRAT)", "value": "aca480ae93ba436295e4f40e50c8433410650677129e1fdca575f3c8d8b10de8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783909364, "uuid": "a98b47f0-6622-4f86-bbf7-a536abc0090b", "comment": "Malware payload (AsyncRAT)", "value": "8f8297759c03d8098cc69ad4aa852e55f28c5406", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783909364, "uuid": "fc96c32e-d72f-4aa6-86ed-a3bbd76a13ee", "comment": "Malware payload (AsyncRAT)", "value": "4320382b6f210c3509bbfc39345ce8adef4ad64cf2671d7b3a01138cec9728d0edb3bf063e46cfb7991f944def79f139", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783909364, "uuid": "ee9e6ab2-6d28-4335-8bac-8d1a841b8318", "value": "T1E5C21A0833E8C672D1FE4ABA883385009779E55B9913D75A5FC490AE29637CD8B18FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783909364, "uuid": "5c50c0b1-9057-47af-9006-39f4a2607518", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783909364, "uuid": "a3873966-9ffa-46fb-82a1-2a351ff26a8c", "value": "384:tTdv2D9YfxWceOsVa/KFHbh0yH9qbuUscCbQxnCJfJBndnjJPVK0m:Zdvhi1VDHF0wIb1BBiBnU0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783909364, "uuid": "b929fdc4-5f7f-4f77-bfb0-aabfb7adb790", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783909364, "uuid": "1a724ad8-de0e-4f8d-b6f2-ea2c1719578d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783909364, "uuid": "03474f11-e77d-49a7-b1d3-23c0b9b75b7c", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66a5089-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783906349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906349, "uuid": "ec38f12a-8db5-41a0-ab53-3a2d5a173cf7", "comment": "Malware payload (Stealc)", "value": "a2ddb304051d7e6756ea938d9d5df0b8", "object_relation": "md5", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906349, "uuid": "1ed321b5-af6c-43e2-997b-1cd289c4e2c6", "comment": "Malware payload (Stealc)", "value": "acf1cd593222c9dc375d3979e2e46ff7b347120a1cc4654bf90f05dee90d20e5", "object_relation": "sha256", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906349, "uuid": "34fddc86-1cf7-49f7-9767-4188f0e13618", "comment": "Malware payload (Stealc)", "value": "57233e298d61da70cb0b9d72ded591a290007ea2", "object_relation": "sha1", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906349, "uuid": "df9be969-67e5-43db-a209-fc1c62e739ef", "comment": "Malware payload (Stealc)", "value": "c0daa623bbfebf2f25ed2ae05003640ecc09f7cf44f59ff976351d2c182fde310ef0bfcff9e6a8e5f955fee4bc525294", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906349, "uuid": "6dac8711-4641-47b9-8766-71f372d1daa1", "value": "T188952301C7C8E071F9B463725CED41432535FEA1EF34A1C773847AAE68A66C4B67236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906349, "uuid": "4b9eb568-b777-4ec5-be64-8362673b58bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906349, "uuid": "b7747fa5-c94d-4c44-a7fa-b8653e829706", "value": "49152:KA+rGZuRYoJYx61ey78F7BPZWxH1C3V5OO4lRHt0zE:KDGIlY9xWxH1C3NuHCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906349, "uuid": "71d36b9d-d144-4a44-bad9-18b203deda2a", "value": 2031104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906349, "uuid": "0960ca8c-6ea4-405c-b5a0-d33bd3df2481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906349, "uuid": "de643a2b-31fd-450d-a174-1d5acfb00b2c", "value": "UndIncomplete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926d93f5-7e64-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783910584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910584, "uuid": "326722bf-945e-46a3-92f3-f78c4eb26748", "comment": "Malware payload (ValleyRAT)", "value": "ce4907cacd3b212e5d05baa6f6a8ffec", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910584, "uuid": "13638f78-2057-4229-9964-4a280861fda2", "comment": "Malware payload (ValleyRAT)", "value": "ad4a584f5e622c10703bca28c58ee8372899edb48cc1ccf28a2cff87d1afbf2d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910584, "uuid": "343cb9c1-9497-49b7-8fed-dc7ea1b34602", "comment": "Malware payload (ValleyRAT)", "value": "e154f026d9135b568253a21271f215ba5acfc620", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783910584, "uuid": "3b5b8dbb-e67e-45c9-a7dd-3be1291d8a68", "comment": "Malware payload (ValleyRAT)", "value": "d18934395bcf4e07e68da497966eda00d90b282cd942f2d40af15e9d394949971b188f981789deaa2cb3852262908b9b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910584, "uuid": "4407385a-390e-4dbf-ac3c-043c21c86a73", "value": "T11CA633DA9C871975E06BC77005A2322C702DBFD4AEB90D0E3DE53A0D9EB25106D776E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910584, "uuid": "4200d6f9-55b4-40ac-9f7e-a15d06ba0c93", "value": "196608:G1UU/jiaIAyxWgWesH90QJNU8ZLuAcYPqzUgZB1/B:wUE2xAXV2+LuAkUYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783910584, "uuid": "656029a4-bda5-438e-a0c9-9b386cae9e84", "value": 9732096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783910584, "uuid": "51a18c37-aa5f-4929-8793-eebc98e0e08e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783910584, "uuid": "6eeeebff-0c89-4463-92b4-337515db26ca", "value": "app_setup.6653007.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6debb6fc-7eca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783954331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954331, "uuid": "99fae926-c92b-45a0-812a-08ea85f8bcf7", "comment": "Malware payload (Efimer)", "value": "8e389a517fa8de44ac433b2ab0610fd1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954331, "uuid": "5db7ed00-43b5-4713-b33a-cd97b8f60297", "comment": "Malware payload (Efimer)", "value": "ae460d66dc6e46b9ee5310e9bd7e420f68a7b57c8cf25f162c18b882f37ba9aa", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954331, "uuid": "0bcd4a12-a6c4-4844-a8ba-e052c7b6d003", "comment": "Malware payload (Efimer)", "value": "20e700ff615370f0573993c43fb20b8cf0d4b903", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954331, "uuid": "bb425a9f-2ea0-4c8d-a6ae-07212afc4977", "comment": "Malware payload (Efimer)", "value": "614e11551e5d6f7f4f25fbe6c407f8c05d6020101e091d2021c04a3611647c4c428ca680c631c354cb3d0ae8a630260d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954331, "uuid": "1edda5ec-df3b-4a7c-a3fc-1af245164919", "value": "T1D6E633689AE026FDF167403DE8F15296F17AB4715B32C69F87888AE39C572E0483D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954331, "uuid": "7627bf11-f81a-40d8-8e12-68b6f88110e7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954331, "uuid": "9bb5adc2-f5a8-4ce4-ac4f-51ee2a2c00d0", "value": "393216:G50tgIDozzVo9hol2rM0glXMCHWUjXzcuI3/PGTAI:GSt1MzVP8rMzlXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783954331, "uuid": "d9f2ff0b-ceb7-4b2d-8c77-1ddc13f9bd8b", "value": 14331377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783954331, "uuid": "eace6670-5520-40b3-9d0b-68d41ac777f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954331, "uuid": "91aea9fd-6de3-43b3-91a9-d5116ebf0047", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4476301f-7f02-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783978314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978314, "uuid": "22067585-fb1a-4c59-94c2-4c9db6c25739", "comment": "Malware payload (RemusStealer)", "value": "12241c02cb660a70f4aeb83d287c7bce", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978314, "uuid": "e530dc06-d0e9-4f40-955c-cdad4eaecd71", "comment": "Malware payload (RemusStealer)", "value": "aec2007bddf386d7659b60f712334d7f277f65edfd9f11a61c711b7b4b7119e2", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978314, "uuid": "ddb9f595-ecbb-4c87-a2b7-44212936878d", "comment": "Malware payload (RemusStealer)", "value": "1166cb6addd7f8083632ceb3aa2612008a3f52f9", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978314, "uuid": "2d72a3d3-ef51-40c1-a1f4-2df68b44fb21", "comment": "Malware payload (RemusStealer)", "value": "c1b406c991fb097f1be565bfc9c7baa2d70453fbfacaf3dff2fb58e77d312a00adceee9282f08ef9d7ce5859bf612635", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978314, "uuid": "86c97710-8b55-4feb-98fc-9c61376ad0cf", "value": "T181A56B0B6CD049E9C8AA673188B261927B35BC094F3623D72E90B7783F327E15D76794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978314, "uuid": "e575e7ad-c0d4-4315-91c7-be6b0a6a2a0c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978314, "uuid": "6d8cbf00-5320-4513-9f1f-ef5a9c3c3261", "value": "49152:c1ixTd3MJ+5rEAzgJvAz9EJ0jOPipSDADt+B2g:c1WdwAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783978314, "uuid": "4d6676e9-ad3e-423d-90a5-d1f760d44ad7", "value": 2171392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783978314, "uuid": "619fba5e-3cc7-4b8f-a55d-18c2247a87ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978314, "uuid": "a461ea23-4643-4f43-ae87-b92abca5dc48", "value": "jee chahta hai movie 720p download utorrent movies.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79931e6c-7e85-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783924716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783924716, "uuid": "11e438bf-c761-4dba-ac89-9c7a1f10a0e3", "comment": "Malware payload (Stealc)", "value": "dc8db3908bec45fc19bfb4d2c4514474", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783924716, "uuid": "58ec55c6-0498-492f-a200-2dfd86025b6e", "comment": "Malware payload (Stealc)", "value": "afbeeeaa7952579bc73b5d220ef1a828ecfdb62b80e339b007f07c82c60ab6da", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783924716, "uuid": "98bb2d38-fa90-41cb-8d24-da76e2f2b425", "comment": "Malware payload (Stealc)", "value": "57c8144bf3a51ef972b480298e05cf3c3d8606a1", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783924716, "uuid": "7329f6c9-f117-4b97-8b59-3b96e31b99dd", "comment": "Malware payload (Stealc)", "value": "38769512ff94f2b4b97915a01ad4e7a8be25f4fcb1506f9a1d0a097df9efcaf97ae0344675ecdcd0a2111f8ab454be89", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783924716, "uuid": "3747a0af-e8f5-44e4-aaa5-226c1ab76c5c", "value": "T125A533530ECE0C53E681633045FA86930E373D824AB1D6CA7B65255E8DB3AD4EA7077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783924716, "uuid": "b4dc2b3d-9b4b-43fa-976c-5084196faafa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783924716, "uuid": "e6f6ab07-2f06-47fd-89ac-22307ed970b7", "value": "49152:5UpzaAXVMh1WI+QhFNwSTO9dsUO0ES1yb78AE6HXy6Bw5Pg:5URX814QrNwSyV0b78AfLBw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783924716, "uuid": "a3bd6358-fc77-45e5-92eb-017a65dcd03e", "value": 2195968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783924716, "uuid": "464796c4-3c38-418c-a60d-d859b79f967f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783924716, "uuid": "fc78de1d-910f-498a-b524-9217e83be2d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7b92b4-7e89-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783926333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926333, "uuid": "0076fe57-c9fa-4047-a180-af69c36ed123", "comment": "Malware payload (Mirai)", "value": "9f53ff394c09d36d2039bd5a0a00f23f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926333, "uuid": "3d3848e6-747d-4123-86a1-65b42ae058f8", "comment": "Malware payload (Mirai)", "value": "b0b3da73bdebf47bdef6c34d603d13d17bed0ea12b81cd694ad81f0d27278669", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926333, "uuid": "85473882-86db-4f56-8607-3b69272eeb81", "comment": "Malware payload (Mirai)", "value": "f08d206ebd8199ad8ac77b9ab6ddb8cfba94a6c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926333, "uuid": "4209c6b9-5c33-4b00-ae54-1e2f8038243e", "comment": "Malware payload (Mirai)", "value": "f6ccfabd57fee3be80eb302ce048da8d8a864480f178d7264e4f9956957108123adb3f05d8906327383d5fc482cad94e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926333, "uuid": "ce32e9bf-cf72-4bd1-861b-53076d106957", "value": "T177F3D717AF602EF7E4ABCC3791F9870928CC655A22942BB57534E434B64B54F4AD38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926333, "uuid": "0c0d4e22-de6b-490a-9c64-66e6cc64390b", "value": "3072:N1s/ulk9UifKJ6XgeKceGGqsRmjBnbquP:TQ6UUifC6XgewGGiqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926333, "uuid": "33aab714-3f44-4db3-86b9-002a10f4e2ac", "value": 159324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926333, "uuid": "5bc4a213-9a41-49ad-ae08-a2081bc5a6ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926333, "uuid": "446d085b-89ee-482d-8d0a-c8fb1c5f2883", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a74b6b-7ec1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783950672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950672, "uuid": "aac43c7b-b37e-4b8f-b025-ad419e7b2eaf", "comment": "Malware payload (NetSupport)", "value": "4e1151dd79dabae691dac265f1f229a2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950672, "uuid": "fd4fb108-1ad6-415f-a687-546ca97d2859", "comment": "Malware payload (NetSupport)", "value": "b11880bbadb5a06cd44f60e08f48dd5592ad9add9377c81810f5216437415865", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950672, "uuid": "451ea0b6-0805-425e-a48e-5af04610250f", "comment": "Malware payload (NetSupport)", "value": "9642f8c43ea574ab1b3010ff83050468f9d3e83e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783950672, "uuid": "4ae6ccd7-c30e-471e-839f-ff592292d723", "comment": "Malware payload (NetSupport)", "value": "6ceb7a8a1011ab9bad288d1a483d24a795867732e613369e99cb763d673bf17e3cb1fa54f95882a2250fff4c71c4fa1c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950672, "uuid": "9c44e220-c390-4642-aa1a-714069a461d6", "value": "T1B841902617E50715D3F68A3AA8F7F3124731B815ED528FDE4240D2C82C64129E875F5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950672, "uuid": "0730085b-b23f-4dd3-80cc-258096acdc62", "value": "24:8E1seOZa+58aKKtHLhWiWAsuW5+/CWP2+/CybfY4I0WROkOFpK6+/CIabpz1vb3a:8E1qM+0CsXubIL3ABcatdMq4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783950672, "uuid": "e95a7fc5-45cf-4bb7-8186-3c5311df6fea", "value": 1896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783950672, "uuid": "4b1ee688-7905-449a-97bb-8d90de373681", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783950672, "uuid": "85429be8-2adc-462e-ab45-559bc0deb34b", "value": "MelonPodcast_InterviewQuestions.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ce8054-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963367, "uuid": "6dab77c0-1c4a-4515-9b3e-49024e4f081e", "comment": "Malware payload", "value": "195a3e8d265cbf7b62d8e14ed8890113", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963367, "uuid": "830078ce-752c-43e9-a634-eb97289844b7", "comment": "Malware payload", "value": "b168ee90804aa4d1788482fd76c7e41a032b6d0acddf2344a9dbf7363fa29601", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963367, "uuid": "75c9c884-d892-4881-b7a2-5a293c6c4b49", "comment": "Malware payload", "value": "75d3efbaaff4f19aa3d123ce8ca9f53a4871670a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963367, "uuid": "cac3b6f5-26f1-4778-aa7d-4afebf57f7b2", "comment": "Malware payload", "value": "cdd2cc3a7b20bc48a35e04d5540ecd602455f1d09d533a396734077a44528f9bde21d64d9c3642c4b6f4fbb0f55b662c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963367, "uuid": "c0e7d18b-50ed-4d0a-8874-7c0b6de76260", "value": "T119E1BB95483FBE5431D44816EE795B149B1330FD9C8483A9F68CCDB6B7E9A0CC2E6E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963367, "uuid": "be5f5095-718c-472f-807c-77fcc633e2d5", "value": "192:FpnjgHdbFSOiEM4vdwzGGht62D41GAglkuWrbU2:FlYdbFSOi54vdwzGGht62D411giukbU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963367, "uuid": "bfe5992b-63ef-48ba-8dc2-ca841ba49516", "value": 7056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963367, "uuid": "7145ad96-b63a-4a33-8762-aa43c8c283ca", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963367, "uuid": "56d98e2a-06e5-410e-b68b-fc81ca77cfa4", "value": "givinggoodchancestogivebetterplacesforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289ac7ed-7e90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783929304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929304, "uuid": "45b1b57f-e585-4b00-bc59-b0cb13d08169", "comment": "Malware payload (Mirai)", "value": "220d2a78396b87a1ab3a3ef8e003cb8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929304, "uuid": "6329589a-2efa-4868-ac6b-c2bcb3087eae", "comment": "Malware payload (Mirai)", "value": "b2a2fcb79e9622a70cd26fc2280f4aeefd78a4d06f204acc3a153b95cd4ce238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929304, "uuid": "3e0c4850-608a-4b73-af53-8be062063b57", "comment": "Malware payload (Mirai)", "value": "87c376bd6447814cbaf42959047a304f1dcd71ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929304, "uuid": "023f756d-4e43-47b2-b5df-7155fba44ce1", "comment": "Malware payload (Mirai)", "value": "736638ce174df0f9ef2fc02b65e84048255e3ec0734855c4488bbc7959ad29e958d77cbabddbc69473ff57ca19e80783", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929304, "uuid": "bf139c99-05be-4772-aef8-e972602e2413", "value": "T1B6E3175AB8829E21D4D622BEFE4F518D332367E8E3EE7112DD145B2437CA51B0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929304, "uuid": "8f711ec9-03a5-4a71-8d96-e8346b0f318b", "value": "3072:H6DpWt0fyTy73xOQXg4u5TBqOFacyONrbUacRuWL6m11HzhYoTkiOnbWFW:H6DpiwQy7JX9uLqOaHw/UacRuWL6mzHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783929304, "uuid": "70a3ced2-8308-40f7-8f40-19babf4e562b", "value": 154088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783929304, "uuid": "f23c6136-8c4d-47ed-bb5e-8e60dbe9a9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929304, "uuid": "39004b6f-b84c-4cc7-b091-1a059383b8c8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e546878b-7eb5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783945512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783945512, "uuid": "b4b797f1-e288-47d0-b5cb-8b056b24cb11", "comment": "Malware payload", "value": "4499ab60d42d1d8050efde6cf567be8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783945512, "uuid": "7be6d4ff-b6ef-4b58-bffc-9d99948c6d9a", "comment": "Malware payload", "value": "b37f25845dccefc3919ec843f8fe2f8b761ebe7a16055911e3d116b3e5fe21f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783945512, "uuid": "989b7297-acba-4b63-a26a-2cdeb57ed817", "comment": "Malware payload", "value": "604b37b713487876b3380cdf67fa26260c342cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783945512, "uuid": "227e09dd-fbe8-4bce-84a6-914ee66249ae", "comment": "Malware payload", "value": "b34bbdfcf8385c8790c3c2777864470fab6975965749d58e6665383b42444eeaaf23c374aa337a34bc6012109dccd7ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783945512, "uuid": "f9ad897b-4542-4259-b204-3a7c74845d68", "value": "T1DCA57BD6226FED85D0965603164F525ACEBC46728F1BE39CB90DDFC81028599E2F0CEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783945512, "uuid": "7800ffb3-778a-4eb5-873c-72f4c3ac589a", "value": "192:AbwWBKm05P39UJg97KGn+oyTHIZAUkvlrK:AcWBKm05P39UJg97Kw+oyTHIZAUkvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783945512, "uuid": "6c651edb-aa46-4c43-b5f3-a3996af27e43", "value": 2231867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783945512, "uuid": "24fc9a22-fb5d-41a1-b7fd-76011faa6d09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783945512, "uuid": "f9c7096f-afd3-459c-8f2d-bf28093aafa0", "value": "PRO840423SG8_XEZC_1892192.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3785e9-7ea1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783936665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936665, "uuid": "3ba88f03-ded9-40c6-a54b-151df8862a31", "comment": "Malware payload (RemcosRAT)", "value": "458cca0e2e189fb07656d414fdf5b574", "object_relation": "md5", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936665, "uuid": "966b3379-3d33-4437-b788-20b7b54fa80d", "comment": "Malware payload (RemcosRAT)", "value": "b3d07e47793a40bf3d99133b7a58feffe5bf8d27ea42a8e45eba322bc02cf8fb", "object_relation": "sha256", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936665, "uuid": "10b6e002-89c9-40df-8f3d-cf24b9931c43", "comment": "Malware payload (RemcosRAT)", "value": "220d38c3215cb9622b402b9701550ca8d29872b4", "object_relation": "sha1", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936665, "uuid": "0696d301-5eea-44eb-bc0b-c7bc734cc512", "comment": "Malware payload (RemcosRAT)", "value": "8dda9d6761472d0891164c0569ba35d8aff4b46067d33404ff6bcfa8300e036c98b82d0772b1e2ac0186a3635d268906", "object_relation": "sha3-384", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "UniCredit", "colour": "#2198E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936665, "uuid": "07c2be5f-ff90-4066-9e5e-2090496f2984", "value": "T19BA5CF19E38D12E8D227D134CBA65232E6B5B81A0761BDDF265EC3192FB79D01F3A311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936665, "uuid": "88bfb8b4-95f5-44b9-bfef-6c5f61c66b5c", "value": "24576:A6K1AZg7pP732P0pgBUHZyOS2fWTkpnCW7in2JqDN0jdb00Iq8RPulQ:A6K1K+gBUcOSrSCEqDN0lnYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783936665, "uuid": "63bd7291-90d5-4f18-ae8d-9c71e8b754eb", "value": 2109440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783936665, "uuid": "43531f67-996e-423b-878c-98e50c8fa7cb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936665, "uuid": "ff196812-ad1f-478e-b2f6-40baccae78b3", "value": "Bonifico n.1101252230290346.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f414349-7f0d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783983110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783983110, "uuid": "1bbf9370-0745-4ec9-9cec-506cadc5464e", "comment": "Malware payload", "value": "83e7e4736d1c22f92243d488a75d4f96", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783983110, "uuid": "b072ef82-6dda-4d72-9dab-cc40363cacbe", "comment": "Malware payload", "value": "b480ccc5728743005a359d21b7c999a1b9b9d5f7a05176ac338926d3c514d7f5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783983110, "uuid": "45678baf-bb52-433a-b3ce-412d6c0f265c", "comment": "Malware payload", "value": "bf05b380e38947849ccc7b661eba40b51f126f34", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783983110, "uuid": "87bc1483-1ca9-48ed-b4cc-044d29d273cf", "comment": "Malware payload", "value": "c4a6acb8ff23ffb9b78676d3e66a1d60bb28d831a53b9e1e35aa96a12f7679fac79214268e25b9da67be103cd9de475c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783983110, "uuid": "f4d20219-4a01-44c6-ad90-1cb7826a9d8f", "value": "T1A0E63308B6E111EDE6B3423CFDB14ADAD4B578210BB2C7DB17A81B646E470908F7D58B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783983110, "uuid": "d0595023-d0a2-4832-96ac-229d1591d299", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783983110, "uuid": "77f789e5-5940-4fed-82d6-3fb521f11da4", "value": "393216:OjBBnSPns0QmrthNYyURglm97XMCHWUjX3cuI3/PGTAI:Ojnmns0drLKd6A97XMb8XMH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783983110, "uuid": "27bc2f66-be1d-4efb-8a89-2b5811cd4f96", "value": 14288169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783983110, "uuid": "9b238c00-d798-4218-b789-c1e01e7f3afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783983110, "uuid": "677b9c97-7dd0-4c46-a49b-37ae896b74e2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295b4da1-7eff-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783976980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976980, "uuid": "3601fdc9-5023-4b3b-9d79-0accd0d1f6cf", "comment": "Malware payload (ACRStealer)", "value": "d8031d7489e07833ca8c4cbc436ce7c8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "telemetry-incidentcenter-cc", "colour": "#EB8A88", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976980, "uuid": "a0e9f0ee-132c-43ef-affe-a406914082a0", "comment": "Malware payload (ACRStealer)", "value": "b50f2a725bec5a139e3bebe5d823af0c25d0a7335adab21b53743c2afdc0b6cb", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "telemetry-incidentcenter-cc", "colour": "#EB8A88", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976980, "uuid": "dd71b958-4891-41ad-8614-7adcf7a71710", "comment": "Malware payload (ACRStealer)", "value": "20467c3c230c63ddec1917ea5a4efc3f46d49a7a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "telemetry-incidentcenter-cc", "colour": "#EB8A88", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976980, "uuid": "fd6274c7-5523-4a64-8e7f-b6feaebedd3c", "comment": "Malware payload (ACRStealer)", "value": "7ddc5928d413e911e59fe123e0c38aa07e287549095944199b631c28b51a32e2866dfe6d802d73e81b8e65a1b5d3ff4c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "telemetry-incidentcenter-cc", "colour": "#EB8A88", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976980, "uuid": "4d0216c4-aa85-4b84-a930-8e7b1c1c8fad", "value": "T1B8373312C56A4F55E68C253AC8C78F016205D7E78501CF9F575AE39FBFE2BF08A21892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976980, "uuid": "f40ecb71-1bd2-436a-8772-4e69d9590720", "value": "393216:JPJant0N1jQ9K68zkw2UJTcy4BmCoz3ycGprtbbXpNFk6E1oV/Z4ukZ6Y6P1:JPkniN1j/68LzS8nJGpNbpOmV/uukZwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783976980, "uuid": "e2c79a3a-87b4-4425-88a1-832920271603", "value": 22959326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783976980, "uuid": "74632f58-70c4-42b1-a8e2-c0b1be21a72d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976980, "uuid": "735c1549-fef5-4d28-a13c-1d529dc291c7", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66299f31-7e5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783906215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906215, "uuid": "69f94b61-e1da-40bd-988c-fee49f038ee9", "comment": "Malware payload (ValleyRAT)", "value": "3fd8d0f57f5c8876caacd2a4fef86ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906215, "uuid": "8625eaa6-004a-4e88-aa17-e25fa32400a4", "comment": "Malware payload (ValleyRAT)", "value": "b5af11fcbde594f47706f4b5a8ee37a20fd4ed1ceb2537c9356ad5f0ff7300a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906215, "uuid": "24be642c-e228-4215-9cda-b68441d23071", "comment": "Malware payload (ValleyRAT)", "value": "c246702f11d9ad9505cf2c63820f0cb34717327b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906215, "uuid": "c2e11120-537a-41c7-bf78-7579698ca9a6", "comment": "Malware payload (ValleyRAT)", "value": "89484b43768b946e224941b69d957b8a38a789aab90679619abdddfa2020474e3d2ce467df54f16f9a699c56d5b9eae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906215, "uuid": "1c43a1f2-5aff-4d76-80ed-4ff1af1fe05f", "value": "T112B5E87BA5A183B8D38DB67EC163A744D433B1764732D0EB61B003668E1A4D19D3BB78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906215, "uuid": "1e90a5b0-4f8c-499d-8256-2b8f35ab3469", "value": "e9d6723ad0e9063b525f384eb48d5a19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906215, "uuid": "03d0cc11-69e9-483b-86a9-5a6f53172ffd", "value": "24576:0gMucAicT6LONFHQPqJWNhBsEnCVLPiSaNYB59uXDAT:jcAicT6JPqJWNhCEnCslwgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906215, "uuid": "bad93564-a348-4eab-9372-39ded453f97f", "value": 2353232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906215, "uuid": "5c405a10-613d-452d-9356-44ecdcb142bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906215, "uuid": "1d95c247-ae10-4369-8f8f-6f3cd9f45bb7", "value": "3fd8d0f57f5c8876caacd2a4fef86ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f3533e-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963175, "uuid": "08cad29e-b57a-419f-952f-7eb444f1be4f", "comment": "Malware payload (RemcosRAT)", "value": "9ca5778a26cf8aa431c1dd4824e3d771", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963175, "uuid": "9c7a6e3d-1dd5-47e9-aa2b-b9f0e7103f36", "comment": "Malware payload (RemcosRAT)", "value": "b64c0c5a1ac3eef38bf27a2ade490c8e22aa837e5a7c15f9129de867f4bdcf72", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963175, "uuid": "1bc8d5ed-96a7-414c-8c73-23b76b0def2e", "comment": "Malware payload (RemcosRAT)", "value": "dea509560a95cde9336067781229df39995bf633", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963175, "uuid": "b7527897-3add-4bf1-bea7-fabd3daaac23", "comment": "Malware payload (RemcosRAT)", "value": "c2e898164742ef022918a90446f0b7722a39e01d05aead57aed8d0d6eb9442a302e8ade95f059607584420b3247a285f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963175, "uuid": "60515b75-88ca-4b42-9104-a0ac581678fe", "value": "T122F42305FAD6CB1BE1E65436ADD4C0AA0028BC227F5A938B3020B70D543AF7B77D5B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963175, "uuid": "c3d096ad-304f-40df-92fc-15aa7ebc3034", "value": "12288:y+32VP3E2Mb6sbsmHARAef4CmJsrP+S0CjrzWzVW05hRFaNrUrK5OBUn6OtSBNgD:yNVP3E2Mb6tz4vOXSZVeYUP6NPmInb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963175, "uuid": "5c973cac-e8ad-47a0-8610-37e88e92c6d9", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963175, "uuid": "4e118f21-61f8-4ee3-8be9-94803f43c885", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963175, "uuid": "e43a0d2e-c73f-43dd-9d50-cf833aeb8d1b", "value": "REQ Quotation Order 0771.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9649a7be-7e8a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783926911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926911, "uuid": "5e845337-58b5-473b-a403-4a000dff8621", "comment": "Malware payload", "value": "f30dd679ace22d149b0d661fadd63adb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926911, "uuid": "6377164a-a860-4d3d-ad34-64d94d79ca28", "comment": "Malware payload", "value": "b6720f25f29a9537aab2082bd08eb966b16d8181e7c538cd9f9ea6bce9fe4978", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926911, "uuid": "8e853e47-8064-494f-983f-b4f95552f401", "comment": "Malware payload", "value": "0828240b58b011b05f1a8ff2aa4447583c4a5d35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926911, "uuid": "c73a1115-1058-4352-b9ec-7b2884214583", "comment": "Malware payload", "value": "1835be084c73163efd00ba4ed2817e5e6978c2b9b0db1d5fbe75799582734ed4127f733e80b2c8b89967b3bf3526adab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926911, "uuid": "413d0fb0-df42-4115-8c61-c1da4a4ef86f", "value": "T109235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A6AD9109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926911, "uuid": "3bb8ea97-387a-4ec4-b7cc-963246e729ef", "value": "768:U+p9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:U+icr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926911, "uuid": "41bc568c-ea78-47a3-9b77-bb066d067798", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926911, "uuid": "284ba8ad-67ec-4c93-80e8-d00d796fbd97", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926911, "uuid": "5176ab28-4088-4fca-b038-c3471e5e4e88", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64f2503-7e4e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1783901249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901249, "uuid": "5a10eb43-9e4b-47ec-93ef-b09ea85ec269", "comment": "Malware payload (LummaStealer)", "value": "0960024eb037c62476bc4d22db17f864", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "logs-incidentmanager-cc", "colour": "#284EAF", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901249, "uuid": "73fc189d-1fca-4d13-9c2b-b6487fbc4231", "comment": "Malware payload (LummaStealer)", "value": "b871f50abbd7e06e6dbede78f499c2efc426d7f8ba08943f06e104f82d8ecc0c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "logs-incidentmanager-cc", "colour": "#284EAF", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901249, "uuid": "bf87f0df-a8a0-4bdd-9350-bef5cce0af1e", "comment": "Malware payload (LummaStealer)", "value": "0fc6d6a2887b18d8bd931151c8015d86429a8389", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "logs-incidentmanager-cc", "colour": "#284EAF", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901249, "uuid": "9bc30d9c-2e4a-4155-87d3-c1ee208b9209", "comment": "Malware payload (LummaStealer)", "value": "a1e84daadfe67d7fa9bbc034553aba63b9c5a97a63c8d7b07d47f84e442ab68481737f33bc39408d4f105918ac7a82a3", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "logs-incidentmanager-cc", "colour": "#284EAF", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901249, "uuid": "c73eacd2-00a1-4916-9260-f77cba0e26f7", "value": "T105D55B51FEC745F2E807163295E763AF2339AD054F35DB93EB047A79EA7B2D10822209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901249, "uuid": "99a09f58-f73c-4431-8ec9-44c24cbfbc59", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901249, "uuid": "d987919d-cce9-4365-8328-8f9e983f79fc", "value": "24576:9Hf9kGKrug/LrfcGGt3Ydcm13EyKm7dsg6SkgIiutw7JQ3QfvaTYayABF6d1OeOd:9/9RTt+IOKV0aV6d1OQFxbsJdR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783901249, "uuid": "e52a9c1f-4e79-444b-983b-a2fc762e4c66", "value": 2761072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783901249, "uuid": "a55e7639-a0f7-41a1-aa24-1391fd54e3ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901249, "uuid": "3df33e01-b548-4573-bf30-dfdeea2d79f4", "value": "L2703900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec265c9-7ed2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783957930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783957930, "uuid": "ff59670e-decb-4a2c-9236-535fd319a1ca", "comment": "Malware payload (Efimer)", "value": "40eea8d73bc1f6356ac6d3f7083616b9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783957930, "uuid": "33b7f9df-52a6-449d-8e68-b0577646a09e", "comment": "Malware payload (Efimer)", "value": "b92b1cc46a2b5ca150981b4202972178a6a522d909cbf941c73f6640c46ca062", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783957930, "uuid": "37bf1efa-5df5-40e9-b1d8-1b053a1a134d", "comment": "Malware payload (Efimer)", "value": "092a332c960a7fe7ac8381790db4bc49c359e8ab", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783957930, "uuid": "163821dd-07a9-422e-a47d-abb08955ec10", "comment": "Malware payload (Efimer)", "value": "7ab84372f0921eb2ee6906ace04b18c8928354081b204fcbd0ca65eb46b6a4e18c655862de36ab5834bf77ee13766b67", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783957930, "uuid": "760c0095-a1a0-41e6-b772-a0a6221fc3d6", "value": "T15FE6331829D512DFF9F35138EEE14660F6F574A24B35C6CF1728A3626E531A04A3AB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783957930, "uuid": "c36f20b6-12d1-404b-8f88-7f5246d95152", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783957930, "uuid": "34d3596c-2cbc-41e6-9125-7a6c6767ebdd", "value": "393216:pJJjty4ZXKCw8qMWabbb1tDXMCHWUjX4cuI3/PGTAI:pJRtrZXA8qMWab1RXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783957930, "uuid": "da96da45-4a4b-4d5a-a336-fc6fda243730", "value": 14301041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783957930, "uuid": "ec176ca0-54ed-4cbf-b915-bc573602066b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783957930, "uuid": "5a453f88-56a8-43d8-ad1b-a9204e7b5340", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b6d252-7ee4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783965355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965355, "uuid": "7577396b-b1f0-46c9-bc58-15c8fe14796c", "comment": "Malware payload (AgentTesla)", "value": "1e61ed24b5ab58820bf7621bb51c2299", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-telewatte-pe-com", "colour": "#742A09", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965355, "uuid": "4ba62d00-f48e-4938-a036-e636cda00541", "comment": "Malware payload (AgentTesla)", "value": "b9496b034ca77f4adbdb02044acac18e6f074ff75c9089c55e33b330c4e5f87c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-telewatte-pe-com", "colour": "#742A09", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965355, "uuid": "a215c9cd-681d-4224-9fd7-afea337f2b48", "comment": "Malware payload (AgentTesla)", "value": "d176953770876df715ddaf312093d7a1490db492", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-telewatte-pe-com", "colour": "#742A09", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965355, "uuid": "bf0cc44c-75ba-4a32-a483-7522c61613f2", "comment": "Malware payload (AgentTesla)", "value": "5d687b8fa302d5015fc8922b9aa5850551a744e054856480681a9fe9cec9818114ea375b6b6512c5b43829f06d107d9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-telewatte-pe-com", "colour": "#742A09", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965355, "uuid": "d771cad2-1989-4987-b48a-c246f27d273b", "value": "T1E945334E38BF5519F9CB5BBC939A810FA66B05AE4254A660FC38813B716D5B3423FCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965355, "uuid": "19154319-6084-41eb-95dc-e3750e52ea25", "value": "24576:AyVlFOYJeBMKMfO9jv4ZpqvQI0sQrSNNUYuujTpCFiR+au6iDMBc:NnFBzW9r4D9iUYzRJiqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965355, "uuid": "5e685375-edf6-40dd-9193-94d0fbffe1c8", "value": 1202336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965355, "uuid": "b340e328-8470-4b7d-b47b-ecca405e31a1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965355, "uuid": "4d2ba47b-8604-4fc9-9933-6fc7491eebe9", "value": "justificanteTransferencia.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c4eab3-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963421, "uuid": "98ae0f7c-e5ea-4dca-95cb-8b9bd61f7935", "comment": "Malware payload", "value": "a3146184d381f6aa1f5c51c7eeb1e5bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963421, "uuid": "2395014d-0bb7-4a6d-9ae0-1b1d15657c05", "comment": "Malware payload", "value": "b9526cc0b85e68a38004d4fd4a4e09dd2fb8b8a57a76fd8065fb34f61441a4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963421, "uuid": "bde6ebef-7b4c-4be3-aa0a-fc7e21c79735", "comment": "Malware payload", "value": "9c6ad895dac1cf1c50ed1d2a3710224febc7bb76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963421, "uuid": "8eb04c65-3129-431a-ade3-d29c01346d5b", "comment": "Malware payload", "value": "3b18e97caa2aa7ead3d91aa1b210a028cfc51cb9686929e9cf70af77ed5f31ffe14fe9d0c625c2977c065dcca696773a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963421, "uuid": "919fca9c-6d7c-4458-8684-3d4c139aaed0", "value": "T1A75208CEB193A9FCC1B58379CA560263C6B470A4132A1FBF13CCC5953B522116EB4BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963421, "uuid": "8e49dbb7-d0ba-45ba-b313-5de8b191de2d", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963421, "uuid": "2950d7b6-be63-4601-852a-699fe57eae50", "value": "192:OO0gonmQ6hHRXAJjCEUVhHLAdRMbf7ZLuLNU5P0/2XLOs3Va:Op5N2HR+jCzhoabzhuLNcA27pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963421, "uuid": "a567d965-cdfe-4824-8af1-2ab59ddf516f", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963421, "uuid": "25e64a06-a598-43bf-8647-f34c10612855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963421, "uuid": "5729c5f8-6fe5-40b1-9105-c4122fc088a3", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3857f7-7eff-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783977040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977040, "uuid": "4ddd1b39-93b1-4d14-b136-e4f5d3e6b05a", "comment": "Malware payload (ACRStealer)", "value": "46106561962c79d6cfbc597f630ff9aa", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977040, "uuid": "377e5903-ed84-47b9-88c7-c52f45cf36ff", "comment": "Malware payload (ACRStealer)", "value": "b999fba4d4db5bdbfa86d6744ba53b4473f37b53d0fe74c47f7c8238350a11d8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977040, "uuid": "93306ce4-1ca4-4fd6-9374-404d8d272a06", "comment": "Malware payload (ACRStealer)", "value": "1592e5fe3881646b3bbda9079b3f7bb327d66762", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977040, "uuid": "f84ce9e8-2064-4150-aca5-a9d627a26bfe", "comment": "Malware payload (ACRStealer)", "value": "371a0f4022745f3079ea4fa7cb60cdcbdb5bcc8ab0ac53468c48b93e9667730b60ae321b6d9ec4c31242991ca894af0c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977040, "uuid": "0eb0b60c-b9c5-4ae1-b925-ee674eaa7ad6", "value": "T1181723BCB4B5B95AF5D4433BC6C12CB2DB2CA540D7D93D9B8E2041927EC320E5F6A861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977040, "uuid": "0ea6208c-a07b-4092-9a9a-652160ea0cbd", "value": "393216:4voJYOm4PaJBjPvwL4835pf/9vV0LCqUMMeEHjtWehhfkiI7UXFDxiOk:4voJd5EtgL445ptvV0+sMLEgh9I7m6Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783977040, "uuid": "06cd8cea-7921-4ed3-a5db-48202ff0c783", "value": 20227273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783977040, "uuid": "1076fbec-6ea8-46f5-b65c-7b71a09de23f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977040, "uuid": "31a3e6f0-3ef5-4762-a74b-90a307aa9bfa", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf8e12b-7e8f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783928827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783928827, "uuid": "3ecaf699-14b3-47b2-9d04-89cece590602", "comment": "Malware payload (Vidar)", "value": "1e8233a42b40e26850f1f6fafeda19ec", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783928827, "uuid": "861d50b3-b567-46a4-9f4e-d1ba6dc5fd7f", "comment": "Malware payload (Vidar)", "value": "bc2297f06dbddcbfee8fb542ef003f8113932ba8ed40dc2f4da361fb94723956", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783928827, "uuid": "1afafe5c-04d3-42f9-9940-d8528a6bec22", "comment": "Malware payload (Vidar)", "value": "0f9adc47ea49883db9c390f0dc408209b5aed59e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783928827, "uuid": "1a785181-efb8-49dc-8753-ef26a1c3161d", "comment": "Malware payload (Vidar)", "value": "3ee63914736e932284e606df7a20e09ea503347efa027e2a932f4b74b504954535bb23b65d5785aa21c60154bfdddc89", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783928827, "uuid": "6e55a902-23fb-4779-8684-953c90bf375e", "value": "T14FD59F076CD044E9C4A6A73688F26192BB39BC094F3637D76EA077782F726D05CB6784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783928827, "uuid": "2c4e7993-1ed4-463c-b51f-ff93c193b635", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783928827, "uuid": "7bfe1f06-6e62-4441-b308-0ad2bcdec457", "value": "24576:o6toKKqJhnhTmnWN93qa8jYC2wf4T5cMthSIBRCUwzRI1nKcPosnRMzrTrDPGLb7:o6tDdJVpPN96jMPk/IBFUIDPRM3zmGgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783928827, "uuid": "e439ef04-36ae-4cdd-9624-b1879d21ee0c", "value": 3018616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783928827, "uuid": "20090272-ffd1-41f2-bf9b-7a28f738a77d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783928827, "uuid": "2a224180-3056-4271-a8ea-541673cce504", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cbcc1b-7e83-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783923662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783923662, "uuid": "7eaa1fa5-2e08-4402-8c1a-b2dbb538bc97", "comment": "Malware payload", "value": "47c84c27acdade2af2a0cbfdbf8f80f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783923662, "uuid": "b72e9602-cc8d-433e-b739-1269b582cb50", "comment": "Malware payload", "value": "bda1cb9facaf9c5e299b00ad219d3d49a1d46d1fdcf93f1ffda2f742f3cb6df9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783923662, "uuid": "177996b3-4d6d-44f4-ba6a-0477f7f73f66", "comment": "Malware payload", "value": "f5cee25c1cb2ea1d3143567bdd038d9dad9b02d8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783923662, "uuid": "e0200518-ca76-4015-ba0e-771e38349c2a", "comment": "Malware payload", "value": "3b376697d2814f6ca3b1a77d871dbe324d1c4e98d0bba59770ae373286b4638f2fb14442a185990b60f9a8de760130d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783923662, "uuid": "ad57d988-3a1c-4adc-9d1c-60e8012d4034", "value": "T165236C651A857C149E98C4371D7E2F0CB9AD43E6321452DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783923662, "uuid": "9511ed3e-dc38-4067-b7cd-f3cd8d9f365e", "value": "768:SVEJVIhtM79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:oEJ2MMcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783923662, "uuid": "1aea1a32-6786-40b1-bb78-fe94f89b4b4c", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783923662, "uuid": "5b7b64e2-d3c7-4958-bf75-7ec0b622da6b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783923662, "uuid": "d776836e-a6d5-48f0-9998-3ab1e32cea47", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60622d49-7f13-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783985662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985662, "uuid": "4d5e476c-9c9a-4d6a-9fd9-ffc1beb8bac8", "comment": "Malware payload", "value": "2498761039531a8db058f399a6fb8021", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985662, "uuid": "34c439bb-ffad-4314-9b87-6e6c73e710f5", "comment": "Malware payload", "value": "be52dd73c5626d66c2c6325810921db26b1ca421c9d08e844a9f621bf1b5aeb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985662, "uuid": "f26ce6a3-f84e-4f4a-b29a-bee8d665dbec", "comment": "Malware payload", "value": "dbf21df008bed59f21c44e18ee996851206861da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985662, "uuid": "81c28d14-aff1-47dd-996d-b24ba565cc69", "comment": "Malware payload", "value": "71079be2961a9d1990a55075a69027ed21dcfa39a7479d8cd4657ac1c7e69dcfe8d7d67e06e6d21d99bac80ead535214", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985662, "uuid": "e2813acd-729b-4660-bdbe-63420583fdf3", "value": "T103A312B3A9C0F211DC3110749F31CA8973F39A68CF76D29599C8D59E5E0A32927ED2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985662, "uuid": "b3ff7f21-512f-46ca-9b29-9aa6871457ce", "value": "3072:0zsHKt6p3j9TXkdx+ekLhLrzeUZgZcDxGg8k0TmBT:023hNXoixCWgZGz0TGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783985662, "uuid": "bea39814-9c00-42da-aa50-4a4b708013e6", "value": 102628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783985662, "uuid": "c7086fdb-c0dc-44eb-a26e-36ae8b0845dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985662, "uuid": "6a9d4aa5-68d0-4e0a-8415-a5c3720c9455", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa35f7e2-7ea7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1783939534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939534, "uuid": "974d7a73-f00a-4005-9413-6b48694dd1bf", "comment": "Malware payload (SnakeKeylogger)", "value": "8b6e35fab68c8094c29ac23a169217e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939534, "uuid": "44d56f11-f935-4091-887e-0493aaa75b1a", "comment": "Malware payload (SnakeKeylogger)", "value": "bf02bd3f34a3f9526386a8fd7eb5d7d58dd30dfb3a1f4767df0ffccd85150180", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939534, "uuid": "5d65413f-0548-4c18-805c-45420828cda7", "comment": "Malware payload (SnakeKeylogger)", "value": "5ad5d27acfd23a5a129779d8c8a2c7651a368ff7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939534, "uuid": "272ebf06-5c0b-47dc-8d0f-1a4b84a4bed3", "comment": "Malware payload (SnakeKeylogger)", "value": "a1c9175a080bf52861abd25f8e4333fb990d97fbf74e4510da716fbb76f308e0aa8ea6ddb5ce02de57507a88141f69fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939534, "uuid": "909e0dee-c95c-477d-846b-90265faf1b03", "value": "T1D6B5D04067C0697C47DE5F3AB63FA0EAF2E10DD9218148C6F721BC44FAA6708DE56A74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939534, "uuid": "bb05ff82-3c02-44dd-95e1-d5b71b947b17", "value": "24576:oGR8ixIzmbvy22vK4qHP+EHeBta+ikFRbNk5pJQdGwjpscW7yEB/+EHeBta+ikF/:oG4P/KraoItSnJ5raoItSnJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783939534, "uuid": "7ded31d5-b485-4622-9229-3e7a2ce10957", "value": 2283506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783939534, "uuid": "39023157-fdec-44fb-ad6d-9426d60193c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939534, "uuid": "3a2f73b1-d634-432f-9dcd-316cae70001d", "value": "MV XIN HAI TONG.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a473c9f-7e90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783929307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929307, "uuid": "382fc370-3727-45c5-838f-0f5a3d57ef73", "comment": "Malware payload (Mirai)", "value": "eea87b062ef11cc9917bc01d34e0a03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929307, "uuid": "305b2d96-8f01-4389-a859-8b0b2ec37b7c", "comment": "Malware payload (Mirai)", "value": "bf0d22a0ca16bf61d274b69ce5bc2724cd40c68082d796fcc8db8732b63d37d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929307, "uuid": "fbf406b5-3bba-4432-b841-4fba553e4832", "comment": "Malware payload (Mirai)", "value": "26763e81aa9ca54fc299133d9aba4ce5940ef5ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929307, "uuid": "77c54a57-dfd2-4ba8-89ae-4ec79aaa1695", "comment": "Malware payload (Mirai)", "value": "d88084db5d5f0d8ceb2fd398a8d17c63373d3a726942c769ab4cdd774a1c984e3b7f5ee606e72bc971569e392d60d5e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929307, "uuid": "1dc455df-5435-4b65-aa4c-ecf4ed1bbb2f", "value": "T1A104C71BEF601EF7E8ABCC3391E49B0A24CC655A22943BB53534E524F64B54F4AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929307, "uuid": "352bd319-a9e5-4a86-b98d-c3d8e0a0faf8", "value": "3072:LLsVUh0D8d7JBBAQwZeyf1Ox3UW8cOnb3yw:3dh0q7/BAQwZeOsx83yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783929307, "uuid": "f5cbe8bf-99cd-494d-8d8c-1c7948ff4a6e", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783929307, "uuid": "5740ea22-4d87-4a6e-99be-39dbe62e896e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929307, "uuid": "014e6c21-646d-4b1b-9c6d-78b737ae04b6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ff6905-7ee3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783965131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965131, "uuid": "433d0110-3028-44f9-9f17-829e94413c79", "comment": "Malware payload (Efimer)", "value": "a1e0d83edc1d1ee22583a41a1bdceff6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965131, "uuid": "029c5428-4add-4c11-bf5e-0d4c47232dcc", "comment": "Malware payload (Efimer)", "value": "bf8e3c6ce89c7f3cfa2a04d93b719b84f83aff5d9bc6fa6e2b7daca71931ee12", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965131, "uuid": "f80be97d-bed0-47bf-bf45-40346faaaadd", "comment": "Malware payload (Efimer)", "value": "be01d7e111e00833c6ae7062269adb3c2096382b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965131, "uuid": "782a76f7-5755-460a-9a6c-7374ce021306", "comment": "Malware payload (Efimer)", "value": "e6b549ad512b8804cb193b22fd3b5b7a2824f2e6b5503272eba8cbae47bf2c420d9e6eb802b291fe8d935d33860c0828", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965131, "uuid": "94f93a14-c9a7-444f-aa5d-e77df5645f6b", "value": "T17AE63348AAE102FEEBB6513CDEA25569E0A9F4760730D68F03E49BF10D471E14E3D64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965131, "uuid": "609da155-18ad-4cea-8b2c-284c3a2da674", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965131, "uuid": "f3183269-ea56-46f1-834f-887209c4d696", "value": "393216:kJssVc7bcpc/D/7J/ywJTxVXFXMCHWUjX1cuI3/PGTAI:kJRcMoDJawJTxXXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965131, "uuid": "6db75d4c-e6c8-4ecb-b2a3-591ec894497b", "value": 14304936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965131, "uuid": "883e7b22-b27e-4694-8561-b77d7787c672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965131, "uuid": "cb612871-cb4c-4a86-9a71-024d7cbb2254", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3169811-7ee8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783967359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967359, "uuid": "4d2ed1d0-d255-4ebf-90c5-a88edd91ef3a", "comment": "Malware payload (Vidar)", "value": "b35489477782e38489f738b306249cd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967359, "uuid": "07ef3408-85d8-41dd-8430-c800ec4d6f55", "comment": "Malware payload (Vidar)", "value": "c08d7b0a6a2c416b664182e5715c49ceb62efa0eea3181f684d308a7e1fa3bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967359, "uuid": "33c7ab38-3721-487a-80e3-c22ba13d6786", "comment": "Malware payload (Vidar)", "value": "c3195fc2bf45567a2a9f55fdb7b4387ffefca328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967359, "uuid": "7a1dddb7-e51c-49b0-8bb0-5ad2fec9b8b5", "comment": "Malware payload (Vidar)", "value": "696133ec281fa66136a30ee4d78fe4da09a5a1f976abe4b12986ace53b68c794a25cecd06c408dcf86d7af4efeea14eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967359, "uuid": "ffc08f0b-8656-4041-b30b-fbcde5c4150d", "value": "T1CDE5AE0B6CD108F4D4AAA77288F661917B31BC084F3A27C72E94B7782E727D14E36B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967359, "uuid": "6b9f5aee-bc97-43fe-a932-0a0aaa182d82", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967359, "uuid": "42c6f2f4-965a-447e-bcf5-e6a53ebd6fef", "value": "49152:CXOOByJm0EtiISCM0jPmGBbBSQ+mNDhZza+AWqH3FrUDWg9p4BIT2:CXJq1Cf6GBbBB+mNDhMlH3u68eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783967359, "uuid": "8dcacb38-effd-4f97-b2c9-7244b34d04aa", "value": 3099568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783967359, "uuid": "b8e12157-cd82-4303-8f67-2e1f9e342fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967359, "uuid": "9890be3b-840b-41d6-80a4-60875384a903", "value": "62.60.226.198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc49d39a-7e89-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783926572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926572, "uuid": "86a9ae38-2bde-4b26-81fa-c97d6cc14547", "comment": "Malware payload (NetSupport)", "value": "b78c3ee6f8be2e61ab989a9d0f834a80", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "golzap-com", "colour": "#2BD9C5", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926572, "uuid": "640ef9c0-4d1b-4e62-ae82-51674b48c12b", "comment": "Malware payload (NetSupport)", "value": "c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "golzap-com", "colour": "#2BD9C5", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926572, "uuid": "2c329603-8cb8-4718-9d77-11c155a3506d", "comment": "Malware payload (NetSupport)", "value": "f951ac3f40b2e5ccb7e63e428df0ea3c686fc44c", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "golzap-com", "colour": "#2BD9C5", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926572, "uuid": "0d9cac1f-df39-4208-a9ba-822d830394b8", "comment": "Malware payload (NetSupport)", "value": "030c0b1934f3808327ec1dc11e6cf54e8a5284ef694b9782f186e39500d9b3df59d64b527648fc75e2c2b7cd216ae8dd", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "golzap-com", "colour": "#2BD9C5", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926572, "uuid": "6b9b087f-9e4e-4a1b-b534-d903543cce3f", "value": "T133F5335E7AC39EDA8C9F3BB4D24D3285803AF9469473775821FBC5164F963C972B2280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926572, "uuid": "c0fa804c-9e04-4987-aa4d-9dc593dd9cd0", "value": "98304:paFBWxVeoWcczqbOy9kSvgmE32urgq0tg:pWBWjeCaTy9lvQ329q0tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926572, "uuid": "de487bfc-b96a-4f9b-ad8f-ff3c02f6504d", "value": 3549579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926572, "uuid": "ecde5c97-5f49-4a7b-9f89-fcdc1f95c081", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926572, "uuid": "a3d02fa3-12b3-4be2-9572-cff6668cb76a", "value": "c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42ff5bb-7e4e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1783901165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901165, "uuid": "fe70d29f-2f0f-4947-8dc2-13c207bf9980", "comment": "Malware payload (ZigClipper)", "value": "8d8762ae9961e6b75bc4b8ce1edfbb61", "object_relation": "md5", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901165, "uuid": "596b2558-d6aa-4e83-a972-30afbed0228d", "comment": "Malware payload (ZigClipper)", "value": "c1d77fd1e31a3470a9b59ec148fd295dcd630fd24fda16f7460ec67eaf0f1c6a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901165, "uuid": "564764e3-6b57-4044-a537-c3a8e8684cf3", "comment": "Malware payload (ZigClipper)", "value": "6e769a664dd64b933d569c7ff6f86a721f92b43a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783901165, "uuid": "c2a48ba9-bd05-4414-9593-5ffdf916e9e6", "comment": "Malware payload (ZigClipper)", "value": "f4bb8e02c30fc557c27cb776fd03f5f85e12211339c205d423edcb31329a194778acba23160031d6feae39f6da524072", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901165, "uuid": "65eb27b6-d686-4efb-8145-965e979d44b9", "value": "T10B465A17BDA149E9C0AE933188B651967B74BC090F3223DB2E90B7782F72BD09D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901165, "uuid": "5de0bc0e-e880-414a-929b-2f17f374cabd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901165, "uuid": "c7fd946c-bdd4-4ce0-b8b5-bad5bc8b799b", "value": "24576:7w7or5z4qu4WfAesZBYYbqPLoPdiCO7oi4Q5nEt07BvA2Bele5rK2y0HE0WhYq:7w7S50qCfZsYcqDAO7ow5nEU8iof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783901165, "uuid": "4b8fa828-fc7a-47b4-a189-8d05dce19477", "value": 5729664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783901165, "uuid": "324c5e8b-c278-4136-b8c3-61545bcd1743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783901165, "uuid": "98d663d8-1dac-4610-a8bd-375df0407989", "value": "clean_driver_dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44477af5-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963281, "uuid": "a55f6334-e5c0-414e-ab4d-9a3b532ab5b4", "comment": "Malware payload", "value": "9b2b8f8fe5bcec9081f97b4d61edf801", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963281, "uuid": "4ad3cbaf-ec86-499c-915a-13cf09301ccd", "comment": "Malware payload", "value": "c1debcb519aa626f814bfad9233e0a7ded6390f6e4fb7d5d6e470b8ae7a03082", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963281, "uuid": "0517c5a9-db85-418d-bf37-f9f16ff1b9c5", "comment": "Malware payload", "value": "e0d4779a59eeb875cc5eece23818c654becc2827", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963281, "uuid": "b9471832-a174-4751-af27-f6283c966ad6", "comment": "Malware payload", "value": "d804154e3a398e8bd85e9ac7d12c851232453a48d18b52525dc76772d2ea5c094389b93898b75d882fe90e844cec518b", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963281, "uuid": "a0cd2837-9297-41a0-bc5c-dc586ddaba28", "value": "T11EF42308F6CBCB1BCA263839D5E1D55D001CFD429E4AA24BB1A2BF0F1275F66D6C7621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963281, "uuid": "e4e233ed-49b7-430d-a815-7704c13ebe9f", "value": "12288:6+324eNCpDyYufWSGBaO0N5zVdGAaET9xwH0HKfrXxj7N8rXc0HcOr4Aq3wjF:6NXcZyYKbcp0NjdGAjPTExjhcM+cOUAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963281, "uuid": "55b1f5d1-37e8-4f94-b684-38eeff33484a", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963281, "uuid": "611d4e99-d4a0-4780-9c89-09b30b5ca772", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963281, "uuid": "2d53b629-5d36-4e2b-8e13-98e323374c94", "value": "PURCHASE ORDER IHSAN_PB 2700.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753c23a5-7eff-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783977107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977107, "uuid": "ed044880-41ca-407f-a64c-e20e4e70b2eb", "comment": "Malware payload (RemusStealer)", "value": "05ca1d2a774b90c4c7e8fe4d3ca57c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977107, "uuid": "9d353dd3-9373-45f9-a4c9-031574290222", "comment": "Malware payload (RemusStealer)", "value": "c20a551057c10e699156ebeb57677cb51625534d8256a3dd3cd8b3efbca5235c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977107, "uuid": "35e17c49-9b05-4cc9-9683-221aa837fe9b", "comment": "Malware payload (RemusStealer)", "value": "2c25171cc19add57d27074daeb96c159b391a992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977107, "uuid": "bac685be-7364-48bd-be8b-6014d640072a", "comment": "Malware payload (RemusStealer)", "value": "f1a98b47276def90696921f38f8a720abc72c0330e0a864315f11cc67f6de5ff761c3b1c95aba5c31fd9044c22b85962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977107, "uuid": "e02ca124-d067-4dce-a8f4-456ec4f97650", "value": "T1C5241967C25371FCD642C07863667232AB33BA3947349EF707A2C7359E22AC05E79925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977107, "uuid": "12c92cc3-4a29-43ff-b92e-759ad398d092", "value": "20f35ed688f00eacb2c7ea603d9f248e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977107, "uuid": "dc318a2b-f819-4d04-99f0-11c39142edf2", "value": "3072:fp4sTRjivIaGBjkdWRBHgT6vrbq3l6gVu1nZw5lmiRyFZg7x55eZ:C+HHvz8l6gVu1nZwyicZg7x55eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783977107, "uuid": "b15d6b7f-49f6-4b6e-9d10-590c3f47b8a7", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783977107, "uuid": "2ddc95aa-f002-4bf3-84e5-c41b16869459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977107, "uuid": "00be6c04-5047-4570-8772-bb842f55b16b", "value": "\ud835\udc7a\ud835\udc6c\ud835\udc7b\ud835\udc7c\ud835\udc77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f08dd04-7e89-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783926443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926443, "uuid": "4b84a2a5-e848-449c-947c-04c157459d3f", "comment": "Malware payload (NetSupport)", "value": "688e25d73ec49de07a747e16b5c1cd4b", "object_relation": "md5", "Tag": [ { "name": "167-148-201-142", "colour": "#CD96FA", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mheusa04-xyz", "colour": "#0408F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926443, "uuid": "6598a811-2037-45c6-bf6d-eae5e2658eab", "comment": "Malware payload (NetSupport)", "value": "c3757a7ff78efa495a43cfa56c60e8da44e151482352910d31b0d5cdca0ee536", "object_relation": "sha256", "Tag": [ { "name": "167-148-201-142", "colour": "#CD96FA", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mheusa04-xyz", "colour": "#0408F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926443, "uuid": "44466e43-3dfa-49a3-84da-15903e9fd2c7", "comment": "Malware payload (NetSupport)", "value": "e4df74631d8cc04aebfe878eeb948e3f1130259a", "object_relation": "sha1", "Tag": [ { "name": "167-148-201-142", "colour": "#CD96FA", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mheusa04-xyz", "colour": "#0408F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926443, "uuid": "e8efc407-149c-46eb-abef-55427770b1c2", "comment": "Malware payload (NetSupport)", "value": "8c11a0199e607e294146655c05adc3954d827846795b193837b461bfa0e2322483a08dd188a9eb56e3ff1cd4024003cd", "object_relation": "sha3-384", "Tag": [ { "name": "167-148-201-142", "colour": "#CD96FA", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "mheusa04-xyz", "colour": "#0408F3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926443, "uuid": "c20ab70b-2a4e-4f23-a7b3-20ab4d10b2f0", "value": "T17E36331ED804E152E1F13070AD25CDF962F261AA855AECD2E34407278EED2F89AF5CD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926443, "uuid": "7988a95b-d33a-4517-bcea-fa30debca608", "value": "98304:/4atlua+1Prv95PR4d1Kcyx3CLiF0iVZW1VXuUrVCm6DEG04wC:/hlut1TVhW1K5sLi2XbMfw4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926443, "uuid": "1052675c-c452-4f5f-9e85-a676029c5306", "value": 4935388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926443, "uuid": "413d4200-6372-452c-99f9-a66ea44338c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926443, "uuid": "20e135e5-c1bf-48d9-b6ee-ad6e7b6dcbef", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc51d62d-7e8a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783926975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926975, "uuid": "a8ac4762-896e-426e-941e-b3759671aa6c", "comment": "Malware payload (Mirai)", "value": "d4d9523161ed22d0861302c9fb873538", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926975, "uuid": "6832df71-6ee0-42db-9158-718b67ee6b0f", "comment": "Malware payload (Mirai)", "value": "c4462552670cbde9dddd6f511809d167f6a6efc4a05b6895ef1cc79a44fa1335", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926975, "uuid": "804a3dd1-f135-4473-946a-0433b5f55643", "comment": "Malware payload (Mirai)", "value": "a52395b7b6a8f44dc95626567df926833610b49c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926975, "uuid": "da2e0187-f3f8-4f8e-9043-c3807ad59c1d", "comment": "Malware payload (Mirai)", "value": "e1e1dd27774a2328a74f33f2b189b5e9f6180e3eea2d512c56e2481f28e88942d2ae3c7504fb046d1cefeb642d32bb2e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926975, "uuid": "11f14900-8a84-4c69-a56a-802b78a23efe", "value": "T19651E5B8D553A7F39FEECE5550211B1C740BAACB34B38D9D9C9E34B4987C984B830A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926975, "uuid": "48ab6447-e5e2-4326-b34c-d9464964f2f2", "value": "24:r05pELMk0aC5EMy0MBswlg4pLKXRCeQ3Kbol4AgHZgHhvmkKXVS3KAW5MAaHiK7e:rMpzaC56SeLidHuHhzGmD/zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926975, "uuid": "26b24025-d269-4349-8d2f-85eb70087a85", "value": 3002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926975, "uuid": "630489ab-3858-4235-bdee-9b4f41d81c8e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926975, "uuid": "6d89dbf4-7022-43bd-9339-a2f640d8f3c8", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844dae35-7ea1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783936759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936759, "uuid": "8e30c9b9-f10d-465a-9c02-be9d732f322a", "comment": "Malware payload (RemcosRAT)", "value": "bc8c370a9bf67ef75534753fb0d601df", "object_relation": "md5", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936759, "uuid": "29c68ab0-f954-4c8e-92ef-492f9846c62f", "comment": "Malware payload (RemcosRAT)", "value": "c4fc9162227b35c631fbe623ee30fa7f660ed015915ed66c76942b1583ac3f77", "object_relation": "sha256", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936759, "uuid": "39e2864c-2008-4521-93fb-0a9352b085e0", "comment": "Malware payload (RemcosRAT)", "value": "e315a7611e35a532955b1c4ddcf8a6c50771cf8b", "object_relation": "sha1", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936759, "uuid": "096d5a4c-fc13-45ca-9312-13a3496291e2", "comment": "Malware payload (RemcosRAT)", "value": "333e41d5a2495057f1483f40a0c4807bc10766a0828f9dc70b694191f66a7778683a9b1d9e5c47fa9bb905203da8753b", "object_relation": "sha3-384", "Tag": [ { "name": "37-27-30-5", "colour": "#BB493A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936759, "uuid": "076acf59-4ba5-4e4d-8d0f-5a20c007d971", "value": "T15AB4AE02FAC1C1B2E5A214340435EF79CEBC7D2108399E6F63DD1D97BD70251E62AAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936759, "uuid": "f0a64e04-8cc1-4e39-bd76-ecfcf844b814", "value": "cd443d07fb22cc071cc33eee6cd16e2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936759, "uuid": "8a678a97-afbe-41b2-8b25-b68825f0b6a6", "value": "12288:HuF79Ut0vm8ivDkK9CDVAm+JEVPngzgDQitc/90msPZG3s:HulFvmJbHsDVAZE7QiWKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783936759, "uuid": "90e7ab01-182f-4380-b258-943faa485efe", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783936759, "uuid": "96cf87a5-ecf9-41cc-97ee-8d6fcf3e3dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936759, "uuid": "f0100371-644d-4f6e-96ca-9cc9ac475212", "value": "c4fc9162227b35c631fbe623ee30fa7f660ed015915ed66c76942b1583ac3f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1485f57c-7eeb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783968355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968355, "uuid": "514de32e-f312-4661-a17f-25c3f8be7ca9", "comment": "Malware payload (Mirai)", "value": "e94a5f067de835076a8f178cf59c53d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968355, "uuid": "61c582e9-d434-435b-a877-c833f2a6d79b", "comment": "Malware payload (Mirai)", "value": "c5208ea8562b3627eded9f9ea09290d132c29fcf8046061d37069056d1128890", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968355, "uuid": "51ce6517-469c-44b4-8728-c5b0062ff822", "comment": "Malware payload (Mirai)", "value": "a30f8433e27eac5c1f81c3934dbe8902c9f94c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968355, "uuid": "65846058-5451-4c46-a928-d87d23d44287", "comment": "Malware payload (Mirai)", "value": "40a692c0dce4cd9aa5619303bb10b5b11ad9fc87325a0cb20d4938ed2bc91cff51adf97c51e0ef3c6756e3889f99ce3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968355, "uuid": "c97c6054-ea19-41cb-81d5-6f2c15672620", "value": "T10EB3124C29356D13FF11D9388A9507B7F6F58E1ABE457A84605080C28F667C8AC8EFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968355, "uuid": "767ddb71-dbdd-4683-8e8b-2b6c08e6f883", "value": "3072:ginlm1hxqIAekxiVVqHcY7BEddnj91xAVI:9nouekxqFYSHoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783968355, "uuid": "e875cb93-d11a-4e2d-a2c0-1f51ad5440dc", "value": 117960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783968355, "uuid": "0f053909-d02d-43a6-addd-a3c77ef3669f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968355, "uuid": "375c951f-fe75-45d3-8282-9c60736e8c98", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534aa599-7edc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783962018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962018, "uuid": "09a4d72e-809f-4109-8395-34aa50eb9c95", "comment": "Malware payload", "value": "799066bda539bf2edd0a9eecc1d5e4a0", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962018, "uuid": "b015c676-4896-4df4-8a45-19502dbe3010", "comment": "Malware payload", "value": "c6b43440ae6bb753a0fdf050bf624b35f37805da7f833bbc5dba257b4240030b", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962018, "uuid": "307e31c4-cb89-441a-a3dc-6118ea3af739", "comment": "Malware payload", "value": "3216662dd82bcd2e77ef92f2f72058b41cfcf517", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962018, "uuid": "0e11e635-b86f-4fcb-9e0c-3984d0d243af", "comment": "Malware payload", "value": "10e5fc660620dab5b8bd206ea8167ed53c4f2fa2aa78c0430c8113abaafeef433f03108a11c6870a69760742edf1e9c6", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962018, "uuid": "06ff5e7a-4045-423b-9a89-99438260ab42", "value": "T1A051B1C176713B313DB758A733691828328250AE6C97DEC965D8FDF48ECEE0579801EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962018, "uuid": "6b9d86f1-d4fe-4723-b308-34fd947a173a", "value": "24:Ijsp0syhIhOMsqxsOAsMACP0s9sVGF7HsyGAsndsFNINk0sui9sE8VsMFsGycs6F:WKHGFI3fiklTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783962018, "uuid": "04eca7bf-b0ff-4ba5-8702-c540777e056c", "value": 2639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783962018, "uuid": "7532cd6f-18fc-412c-914f-350101dfb6ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962018, "uuid": "d189779d-e38d-45f1-b203-c3bdf1e08416", "value": "c6b43440ae6bb753a0fdf050bf624b35f37805da7f833bbc5dba257b4240030b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adf272a-7efe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783976579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976579, "uuid": "7bcc4c39-f676-45e3-91a3-040a7e8113ac", "comment": "Malware payload (RemcosRAT)", "value": "01056cfcb7496b040d87a1a2dc92a66f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976579, "uuid": "5234eb82-9156-402d-9942-22b1ca2352e0", "comment": "Malware payload (RemcosRAT)", "value": "c73c47b85140212238b5fa19dd5753ac0962c03df4c2bb4afbf25e43c23a2d0b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976579, "uuid": "c5b1c330-dc54-430d-9c37-c390713dd2a0", "comment": "Malware payload (RemcosRAT)", "value": "8ec8005b9ee19c4f457fbd53a811fed8dbe1510f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976579, "uuid": "46d8a710-aea7-4efa-9a13-48cac955e74c", "comment": "Malware payload (RemcosRAT)", "value": "e98e71d636689c858004d12c6d724057f20353feb13dbe1ab3c4bcb6ed61075686acfa0f8469d4dc8ca13214720502ba", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976579, "uuid": "de9b43ea-a1e1-4f2f-a402-a93dace8bde6", "value": "T11E03D87EE334EF7E8BE6D5A4802C5ED098B5C576F8588610B6ACC1633BF8119CE24274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976579, "uuid": "48914dcf-e230-491d-aa4c-6b220ba47ae6", "value": "96:KQ27xsUneBln0BdnZBGBNxgqB9BLntbTKoMWcnUxCUx3UxDUxrUxUKoMWcIUx7U4:KZcINw3DLXSWUL28YaWLUjQexYXEVZDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783976579, "uuid": "852fd33e-d92b-40e1-9670-2ac2c7dcc136", "value": 38564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783976579, "uuid": "bb4578a3-a1f7-4759-97e6-22841593f95b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976579, "uuid": "d5ebc252-bae1-45e7-a163-dcf2261d659e", "value": "givemebestthingswithbestprocssionthigns.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba637239-7e89-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783926542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926542, "uuid": "479cf5d0-9d19-4a91-8932-3576c104d6e7", "comment": "Malware payload (Mirai)", "value": "9d1523a2c6c3548cbf65a0ef9edf2130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926542, "uuid": "93ae99a3-7447-4ead-a5ed-615324a1bded", "comment": "Malware payload (Mirai)", "value": "c8730394317e1f0be4fe6465b968a3357d37ad715f9c38db7c85fb509bc303ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926542, "uuid": "9288d2fe-d4b2-4342-9ce7-c24d519b4abc", "comment": "Malware payload (Mirai)", "value": "ba1de99ae1d042d50ca7edf1aafcdffe1eeefd8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926542, "uuid": "50e5f4bd-96f0-481e-b58c-590a01731237", "comment": "Malware payload (Mirai)", "value": "562796a9e8c6ba8cf570fbd6ebd5d7c79097061e73631a23f5553a15b3802c6ccb68eb669bb6fdea044c4c2bdb40da0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926542, "uuid": "234647d9-0d71-4718-8e72-27c17ce3e4d2", "value": "T193D37E5C9D1E7DD2C2C2F2FE6D050F66312675744A68C3F6290062CEEBDEED698B1422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926542, "uuid": "79cc82f8-95bc-4730-89f6-fb7962c283c6", "value": "3072:bOHHXYQV7DcU3ng7P2uFB5Xj2GbmeIF/wvBCKhR2Z/:bCoIP/kxB5T2G5IOvUKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926542, "uuid": "bf0143bb-c8ff-402b-a532-c79c3b5bdfbf", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926542, "uuid": "fd0c5d9b-b0a7-4520-a9c4-cee832ff78a0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926542, "uuid": "1d21473d-8128-4b71-8602-bcf4499bf3c8", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6168a3-7e57-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783904826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904826, "uuid": "b3ea9775-8466-4277-b880-efc2daedc0bd", "comment": "Malware payload", "value": "b7f341ece7cf17d1bddcc297b54c9564", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904826, "uuid": "a77b8e51-80aa-4ccc-b25e-67b7a5340dde", "comment": "Malware payload", "value": "c938353d905fe678c4e8d9e732222eb4b651c096bc69149cf9e49d6b788cc500", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904826, "uuid": "1dca867f-fe61-4937-8505-4dc8d035aede", "comment": "Malware payload", "value": "a8d71c39c43db3d91af6803b840dab1bbd973e03", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904826, "uuid": "2dd46703-39dc-4bd4-8236-fa676ccd908b", "comment": "Malware payload", "value": "689803186876c5cbdfa3cd07c1a10d001895684bd12230fd3eaf91a4fe8a03964ac91e8108d4aa73e4f71ab8d663989f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904826, "uuid": "325d93d0-d994-4a86-b160-2f62bae35c2f", "value": "T1B47733966A2C304BEDC1CBFD49A639CC1057359C18A13E6E5F6B4471F673728BC2B862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904826, "uuid": "f1f1f436-e870-4b23-aca7-e812f79ae321", "value": "786432:tnNcJdJq2oT6cnKkiFfPPLoaf2SlcSLEMLRV3+LJPKO1PWv:V6bqHVWfTRVOPKew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904826, "uuid": "c7fa91e8-1d17-4e11-be3a-bb988fd4bb6a", "value": 35734188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904826, "uuid": "898a7aec-2477-4b99-869d-488e0fb46929", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904826, "uuid": "1d35efd3-fb04-41cb-8e77-887b8373b55b", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50783345-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783963301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963301, "uuid": "b93a721a-30b7-4845-b70d-c4af26acd21c", "comment": "Malware payload (AgentTesla)", "value": "dcb85b6cf651d90e3ecb271d4ca2444c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963301, "uuid": "a315be1f-5fef-4789-bade-f927dd7655dd", "comment": "Malware payload (AgentTesla)", "value": "cab102a77fbb862f897f739bec603105ed8f49345410ff56da8b51333dd6c2fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963301, "uuid": "755610eb-9fe1-495e-b82a-f0ebe7510e9c", "comment": "Malware payload (AgentTesla)", "value": "4134b08a09da6f4852d128aa122ddd220d3c9c77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963301, "uuid": "e444ca6a-c774-4d21-8cb5-333b2beee584", "comment": "Malware payload (AgentTesla)", "value": "c6deb97017a2b4a5026881f616f1fe051faba8160d09ee91be15b936018b75484be64a5de79173ee062ab635ead07097", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963301, "uuid": "c97183a5-1931-4ae8-9c48-293bcf0293d4", "value": "T12725236A7B909B97E967A83911F7C8E5040DAC441F1AC00F313673097B7C77492EA6BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963301, "uuid": "b46f8056-e9d1-4bfa-be47-c1c31c4d6e2a", "value": "24576:5fwI/ulL7C8zX66/KE+SOm+9Rqk2sp6XFaUp9un:5fwI4757BKJ1F9Rqwp6XFaU6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963301, "uuid": "47a0e5c0-004d-4f49-b11c-73a3f090dcb4", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963301, "uuid": "5ea9916e-3ec2-40ba-9ccd-0119daef67ef", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963301, "uuid": "a6c65a15-4187-4750-bbe5-e36f34ad7f32", "value": "Order 13-2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6960b331-7ed8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783960337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960337, "uuid": "4e00d348-1f6a-4a38-aff9-899e9ed8e04e", "comment": "Malware payload (AgentTesla)", "value": "7afdd824c99b170d2f2bacd172128d2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960337, "uuid": "9f2f4bc3-39b6-4dab-96ea-59f5f448e9f1", "comment": "Malware payload (AgentTesla)", "value": "cac491234125411fafd0c83e6f46066af9e4104c4d12462d09af8225f64006da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960337, "uuid": "dcc9b3d9-54d9-493e-a6e9-307eb5050fe6", "comment": "Malware payload (AgentTesla)", "value": "38ec84f3853bcc13d75471163ea0d0dbbfc714ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960337, "uuid": "4cefad6d-c008-4c76-b60c-fdd736fbf5c5", "comment": "Malware payload (AgentTesla)", "value": "168207f0813c5aaa224ba12198219d49e34776e95a529135b67e7e47ecebfd341c8435291c45bbf791790154e4e3b547", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960337, "uuid": "3b60d490-524a-4754-899f-e65b4688ebbe", "value": "T1642512ACA648E613C89963754EB2F675126D4EEDB800E3938FD9BFEB3933C165C11142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960337, "uuid": "c18210d7-ca32-4778-9ac7-ba12fb81adb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960337, "uuid": "dceb62cd-aa07-4101-bf64-f17ca5d6f89d", "value": "12288:yU5UrfvUy91e0VKjelgdE5Pv9WOhx77DQRZ8TOpesgVjyNICMqFAuZWAeu/OwH:8UeZEqlK6ntfDyqSg4NISZWAf/OwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783960337, "uuid": "2c4fd94f-01f7-4a4c-ae2d-3305d70f41c0", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783960337, "uuid": "2ab37ed9-7487-4093-88c3-b49b5d602e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960337, "uuid": "769d2d96-e032-4865-8d38-fd55b819b2e4", "value": "Orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162f6e44-7ee0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783963633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963633, "uuid": "1d11a65f-fe69-40c8-aa0a-5f18b8aebdcb", "comment": "Malware payload (Mirai)", "value": "9eb713fc117a6605de3b51009efaefd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963633, "uuid": "49b46f88-a6ff-45b4-a28c-e047821ef36a", "comment": "Malware payload (Mirai)", "value": "cb7804f1b483369c8e20832fb184eb8fe480d494497c49ec6018dfacf7e2f0a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963633, "uuid": "c99bff77-6087-4a71-817b-75cd0c346a5d", "comment": "Malware payload (Mirai)", "value": "48d9cbe6523af09b2cf8e5d3d64661f8c0e63067", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963633, "uuid": "dc0489c9-a6cb-43a7-be46-4d0897ed59f3", "comment": "Malware payload (Mirai)", "value": "e4dfe0bb4c4ec49456288bcc9b350f1718567218d129ad1b3b3a9075a38576018a6abbb1987fc0e7d93f51fe4dff6af7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963633, "uuid": "2727de5f-e66d-4ddc-8092-8e3153b9b664", "value": "T16E63D806EF514EFBCC6FDE3745A80B0231CCA54722A43B7A3674DA2CB55A54B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963633, "uuid": "b6796290-44b7-4c1a-9003-a0f078bc691f", "value": "1536:Lcc/cM2jXovSlIeN93P1lzi31FhRLjKw+wIzRe7:oUc92eN97kr5Ke7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963633, "uuid": "be973bcc-358f-40ca-a393-f879d67c4a79", "value": 68428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963633, "uuid": "be05897d-e80d-4d6d-8629-9529f9b9689f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963633, "uuid": "f2fe8560-9108-48e2-b100-082cf8a1e294", "value": "SecuriteInfo.com.ELF.Mirai-DJO.61244343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff0123b-7ecc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783955408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955408, "uuid": "beaff0e3-f06f-4ecf-a97e-5ae2bfa3bd9b", "comment": "Malware payload (RemcosRAT)", "value": "11fdd02f407fece395f0fb22fbbe7fdc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955408, "uuid": "60e1ba45-1041-4800-b9bd-bd630a076b34", "comment": "Malware payload (RemcosRAT)", "value": "cbcd9d42fda0f69e62c3618fb3043804776b3408708549315b0016a7a96001d5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955408, "uuid": "0ee678e5-8645-4771-96c3-bbdd33a8e215", "comment": "Malware payload (RemcosRAT)", "value": "d71597ed09b11472ed3628a4cba0daf5df7864d8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955408, "uuid": "4e1bc160-4941-4981-b610-a6b5a0d67528", "comment": "Malware payload (RemcosRAT)", "value": "d4c5e3c9391abc2e0ccb83e069e5703314768417b50cec5f72bbd4b845ed601356408822be03d4124b557226ea1cc4b6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955408, "uuid": "4282bf9c-5a07-4dd4-8932-eedd7f7a3b14", "value": "T17CC4226C32D6DE1EC23B86388F81D0CB540AFC921B49DA2B2B65774E593573D165B08F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955408, "uuid": "2f744502-b5b2-4bc1-ac74-72680d6a35db", "value": "12288:8LkAPXRCY+79QG0Z3S67048ImIZsSgRcEUwqsR0YQqOO:dA/E8f8ImuRE8sTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783955408, "uuid": "3996763f-1d9b-460e-9c85-503357a5297b", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783955408, "uuid": "b79c9f0e-494f-47b5-b3b9-c707e9203751", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955408, "uuid": "bfd4991d-c83f-457d-9f73-ad9c7e5bd8be", "value": "P.028940.22.S-R1-PI-MT_SAM.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd21ed4-7f13-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783985849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985849, "uuid": "5417a983-0ffb-4bcc-84b1-c8b25d1e49e1", "comment": "Malware payload", "value": "4b89602cea499c0d4623f1ae8dc779cd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985849, "uuid": "a1ec91c7-66fe-43ef-9aab-860c900db44b", "comment": "Malware payload", "value": "cc6720ae14382b85c1eafa9d5a04460d2e434d1cfc618dbaf9e0d6679989f535", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985849, "uuid": "f32625b8-6db2-43a2-ba0c-765ec313ce56", "comment": "Malware payload", "value": "8b1a3273fa3c4d1b329b7ea8d0247a6fffe6d6a3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985849, "uuid": "4ca3bded-4684-4833-9cd1-3af770957d47", "comment": "Malware payload", "value": "cfcd84b33533151efeec6418a6548dac112a25c3f6d8b55f194f1badd622eb3105f02e26ccb00f3de2db77e620a1296b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985849, "uuid": "525d4781-f234-4ee7-84ca-9b90f0f3c105", "value": "T19D237C652A817C14AA98C4371D7E2F0CB9AD43E6320492ED7FCF3CF68C5A69D921871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985849, "uuid": "b69db1bb-2b11-4c4c-9b3f-c0e9e98013f4", "value": "768:8XOGVv6q9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:CLy/cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783985849, "uuid": "4abaf5ce-1968-4b7f-8b03-545c7b0c922d", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783985849, "uuid": "b93fd82b-ffda-4e31-89e4-4d1b1f365231", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985849, "uuid": "f4c5fb32-388a-4b69-a5e1-14023e32bdc1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b6cbd7-7eb0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783943117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943117, "uuid": "f1148fb1-8fbd-4996-9063-17608004ee98", "comment": "Malware payload", "value": "a7812d5e9cec1f28918b8b75b82f3c5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943117, "uuid": "489a0e1c-2b3a-4899-b307-9d78bf155344", "comment": "Malware payload", "value": "ceb55891d866b719c8ef43b26704d3114fe19c94c71f091a7654be21abc32355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943117, "uuid": "f6a18bff-06c3-4b43-a2fe-4ad3898d4b3e", "comment": "Malware payload", "value": "9904674ffb1ec1accc8e0cadfd53d74bd758a12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943117, "uuid": "e6f56d02-e843-4622-9f15-879cf451f2ad", "comment": "Malware payload", "value": "09b56008f30c47e56bf57bbfc203852934226f3f0a137f5a52f67216eb7030ae68365b168682ad88bdc4ab9e7c258f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943117, "uuid": "49a683f9-66da-4d9d-bc1f-13b4556ec4e7", "value": "T19965234223E441E5CCBD073084F2A3534EA9BCE16B745BA733D6958E1E739C8993936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943117, "uuid": "d5035350-362f-4732-863f-0aaada89a2c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943117, "uuid": "f09b3b74-ba09-4a58-8a3f-19f2ad4386dd", "value": "24576:dFp5lA/hikGzaIs3mS7dB1d/MfPgri9uoexNPWm0KgpQrPeWGpKgiCFFHe2XoJ6i:l5s4kGFs3mKXBMfCisoUAppQrPEKnSFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783943117, "uuid": "3f501d6b-620c-4862-ad8d-375c84240d91", "value": 1482240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783943117, "uuid": "c992507a-9acb-456a-b11b-2593c6bd9809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943117, "uuid": "45b931e5-8f6e-4f0d-92cb-dc7cf6368e23", "value": "lnstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6c211f-7ef0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783970515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970515, "uuid": "3ed001a2-288d-4ecd-a578-895ea233f39c", "comment": "Malware payload", "value": "89f1489da995dedb3a96144d7095a8d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970515, "uuid": "a75ee36d-4565-48a0-90f2-89dd831f0f9c", "comment": "Malware payload", "value": "cf21abb094564456f930a36e5276b1a7e70290c91c04058c603fd14a078d1c56", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970515, "uuid": "d6a20750-7d12-4ae6-8425-8f0c70c632a2", "comment": "Malware payload", "value": "a1b28cd1addf6161fd9e34fb8299737698161abe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783970515, "uuid": "d73ee2c8-6799-41dd-8fbe-7d7f99f2bcc4", "comment": "Malware payload", "value": "11b4fb9ae409308901ff0edb976bb73308995b43b99e91c96783917e43bf91afae361bbab4fe44abda600db5145c8e75", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970515, "uuid": "32dcc9e7-de93-45a8-a497-c405069f0db9", "value": "T145C27D966A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D4B3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970515, "uuid": "15792db5-92d7-4c7f-a802-2b7820229647", "value": "768:R8vCB+25j6es8RF9FYpMSUpi+20qUpi+20YQX:R8l25Jjd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783970515, "uuid": "e42dde20-5ead-4fe5-a4ad-a8c9f46692cc", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783970515, "uuid": "a2400fd4-67db-4c72-a531-cf152a043105", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783970515, "uuid": "4afdb587-774a-4f49-ac2b-ffe58bfa365f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf65e24-7ebd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783948771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948771, "uuid": "1f258c24-555b-439f-a629-9a15abd435d3", "comment": "Malware payload (ValleyRAT)", "value": "b83b607adaa4e982a4dfa29c57306a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948771, "uuid": "f3451273-e811-4121-893d-0a9e188aaa42", "comment": "Malware payload (ValleyRAT)", "value": "d11e793159f0da3c88a9ecebb8e5df88919843a1eeaaf71117377db58224a1ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948771, "uuid": "d0df7274-6f19-47e3-a310-dc07b3193272", "comment": "Malware payload (ValleyRAT)", "value": "27476d28d66e08f6f1a2b9886ca53e3fff316f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948771, "uuid": "eab0825f-8f7b-458b-a428-04b5841bdf68", "comment": "Malware payload (ValleyRAT)", "value": "f1986f733923eb8d18b8951f7e8408ef87772ac84181ac68ebdb37418acfb653fbedcb7a5a3add523e0432ced198cd63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948771, "uuid": "15ecb6a8-b5e7-4ba0-b61f-c9af236c4637", "value": "T100637D44B3DC8612E2BE8ABE00F2570683B6F9978913E78B1CCD59AC0D763D19E10793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948771, "uuid": "6a562069-8fbc-45cb-8493-af67f260afc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948771, "uuid": "3202482d-7628-4e65-a9e3-4a4c4455e8b6", "value": "1536:KsG+Dj/75KE4KqysQKQLKXuFe/X+h4EpvouSSSSoSuTikFH8eceAl0:KN+v/75KE4KqpQKQOYRSSSSoSuTiO5k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783948771, "uuid": "d8f9afe8-d7d4-4319-a3bd-356bb49b89f8", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783948771, "uuid": "bad23a71-a5fa-455b-ab35-1cf53dd0a483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948771, "uuid": "db2aba3b-8155-490e-9159-f7f0f9a75559", "value": "\u0926\u0938\u094d\u0924\u093e\u0935\u0947\u091c\u093c \u0926\u0947\u0916\u0947\u0902.pdf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0c665e-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963192, "uuid": "8e145377-6538-4951-937d-b3812296e105", "comment": "Malware payload (RemcosRAT)", "value": "8c0fc3841cc122d0b08ba0b0c13b79ec", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963192, "uuid": "b64d81ce-9055-4e94-8041-c5031cc3008a", "comment": "Malware payload (RemcosRAT)", "value": "d1ac9e66684859b24f427c74264c623ff1e595ee870cc5001fc5bf3329487e8e", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963192, "uuid": "a26ab891-d607-483c-9491-d52d783549d5", "comment": "Malware payload (RemcosRAT)", "value": "f7a8ccc302830fb157b20a57a8d36b690677b46b", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963192, "uuid": "0924f869-6f54-4d25-bee8-73b308463ba4", "comment": "Malware payload (RemcosRAT)", "value": "d9ea1eb94a474ae63bcd6aff2b03285d1668061d64e22e20684efd7c1549a8c8b12f1830835a1da84ae6a45a881211e5", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963192, "uuid": "0ebf97b3-6628-4279-8c35-c35241388b7d", "value": "T1EDF42314B6D6D323D367E83909F4027E4138FC611E2151AB31A6B74E99387FAC8B3B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963192, "uuid": "6ab8249a-43c6-45f0-9d67-e0981a88f42c", "value": "12288:2+32804ULuTlJkI06ORuJ6PzS0JOr5wT+9wyU9PQSw/O74Estj2FDwQt23EYXBrZ:2NBLINPWFQ5OmOsEsJ2tw62vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963192, "uuid": "8885bf2a-c6d7-476e-96e5-f6d4110d6eb1", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963192, "uuid": "fa75f6aa-1d1b-45a3-940c-4cc8581c078f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963192, "uuid": "0acb4808-0a27-472b-8c34-94d29eaae077", "value": "information details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5029ca64-7e90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783929371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929371, "uuid": "dc7afc12-31be-4dd0-8780-6c88a26f9076", "comment": "Malware payload (Mirai)", "value": "6f8beef8585d9ba76e6c2a56ca9b27fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929371, "uuid": "cbae9aa0-c862-43df-a1a9-06b920784b50", "comment": "Malware payload (Mirai)", "value": "d2bbe28101725efcadfb6224ddeef7deee8116205d60708e82f9890d8a0e1460", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929371, "uuid": "a464f453-675d-4760-abdc-aa7b8d27dd27", "comment": "Malware payload (Mirai)", "value": "f51292506ff3987cf849a7bd785385731ca6da6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929371, "uuid": "8c396ca4-1ab2-486e-b16d-ff12b9b00507", "comment": "Malware payload (Mirai)", "value": "5b9ed75fb51b4f37e67a70a6fae8b1161ad301afb81403f74cc213e08581df256589608f11fb52adb0a72f77a6798fb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929371, "uuid": "acea9a94-fc02-4b90-ad29-d81d891cef64", "value": "T18C04D60E2E268F2DF7798334D7F78A25965473861EE1C945D2BCF9012E2024D741FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929371, "uuid": "1ab55441-520d-4fe6-a6c2-416b5c66bf9c", "value": "3072:hYfNwQ2sIONlcvq0KHZol+QJS9Ha+SxSBOnbXG3E:h2NwQ2sIONEtlPe6+70XGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783929371, "uuid": "ea37c63d-1a5e-4798-b646-c866bea897ec", "value": 174660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783929371, "uuid": "0cb637ad-bfcc-4f5d-9c19-830f67f567d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929371, "uuid": "237dd9de-0e7d-4d2c-b953-bfd0d2a9fdfd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8add239-7efd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783976334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976334, "uuid": "eab18880-bf10-4cf5-96f1-888ac42832fc", "comment": "Malware payload (PureLogsStealer)", "value": "02d68788bbd86f7df4c18ba9fbdf80ac", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976334, "uuid": "5fc7e18f-6797-423f-8374-5af5691afac0", "comment": "Malware payload (PureLogsStealer)", "value": "d39142fd261676d1c0ef0b817c44afddc800f6e7b3b1ffa2f2d9a27f548a5095", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976334, "uuid": "96a1a71b-bfa0-45ae-87cd-6a45b09704a6", "comment": "Malware payload (PureLogsStealer)", "value": "c842bcbd2fcc07f1a51f6233c00f9c6b16910352", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783976334, "uuid": "f2fac1b8-5db7-45ea-98d6-2e14388f5e28", "comment": "Malware payload (PureLogsStealer)", "value": "58850b886b631911136ddb7dd5f3c123338e4c1d61638faa189ce227b1e5c6c69865c7936d9a411b0fdeadbb81c02bf7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976334, "uuid": "62d5aa30-206e-4d14-8a46-1839f8366e38", "value": "T18603DA783D808D62579222E50A569E3561F24F5C76480C3CBEFD813A9324C6A5F677CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976334, "uuid": "e4ffc8b3-c93e-47ea-95a8-5bd6ce0b8c05", "value": "384:fF1VVnOKVrFTCvSu9wkv4V723+V65VfRFdqVKVeFiFYqVp:9gUEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783976334, "uuid": "0354b688-8dd2-483e-9113-82ce5142bf9a", "value": 38511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783976334, "uuid": "63607122-bffd-465a-ab1e-014e6f001a09", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783976334, "uuid": "23f158c2-2ba8-43f9-8217-36d95e15934d", "value": "cxc.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c026a6-7e75-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783917696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783917696, "uuid": "63f18461-b100-4460-8648-13f6cc5b5a26", "comment": "Malware payload", "value": "ac3a9a88b4f2f51a7801ae48a53c250e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783917696, "uuid": "771cf5d4-ff8b-49e9-a655-21c9d04becf2", "comment": "Malware payload", "value": "d46c92e092c038c8f5cd01dd5204d76bb0961823a91103559a72367050c869c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783917696, "uuid": "05b7752e-722b-4730-b588-67f3deb0a1f5", "comment": "Malware payload", "value": "f6323dc52b8446e37932a18821d643fe32a9e57b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783917696, "uuid": "bb3cc5d3-d605-41c5-bc5d-7fe84da42c47", "comment": "Malware payload", "value": "b25eded7083e115e49450ea01807b92ac10de082c32a1810fe7b18f17fbe7629e3745aa45672324d148a12402486ae88", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783917696, "uuid": "f5e77cf5-fc6f-45d7-96f8-bf3d951d5998", "value": "T102236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783917696, "uuid": "967f0b3f-b565-4f8c-a670-8835f9c7b22d", "value": "768:wXRWNGxV39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:klxacr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783917696, "uuid": "ef39086e-b490-4c9e-8899-38ff0b1291c2", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783917696, "uuid": "edd52d22-0952-401c-a7b3-b6344cd768c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783917696, "uuid": "d8fc05d9-3ca3-4e55-a13b-78a59acad187", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f3edb7-7f02-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783978288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978288, "uuid": "137730d1-9638-4c2c-ba46-2d401fe0bf09", "comment": "Malware payload (RemusStealer)", "value": "48c1aaa457882fdcca82c647071c1eb8", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978288, "uuid": "ccc41d09-769e-4505-814f-dcc2c1809530", "comment": "Malware payload (RemusStealer)", "value": "d5d5465b53f72727b8218dab4165b954748d29ab8f8de275fbd3a6fac0e08b6d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978288, "uuid": "bbc3c102-980e-4639-b0ff-34e33b9a5231", "comment": "Malware payload (RemusStealer)", "value": "fec96bfbea1db91d9dad11a2873b503bc8c00645", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978288, "uuid": "2d7c977a-f134-4f40-9ff7-91c375ba479d", "comment": "Malware payload (RemusStealer)", "value": "75c43026ad7342c3f691bb68fc99a9049ef22a1ee3337548b2240e7bc2f18b072672b9323731c6cb33facf097fd317be", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978288, "uuid": "00bc15e4-11dc-473e-b163-978f49240a6e", "value": "T1DCB56B0B7CD149E9C8AA6B3188B261927B35BC090F3623D72E9077782F327E15D76794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978288, "uuid": "574b9a51-5a2a-4280-9fdd-97d9e7ab45a0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978288, "uuid": "e3fda21d-ff65-460c-89b1-b77d2f8422fb", "value": "49152:a1ixTd3MJ+5rEAzgJvAz9EJ0jOPipSDADt+B2g:a1WdwAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783978288, "uuid": "34f83fbd-e5d4-4d05-8a54-a0fa10826cee", "value": 2276864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783978288, "uuid": "b35176ac-129d-41f2-9cc3-1f52508e9643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978288, "uuid": "ca604659-d907-4bd9-be0a-09247fe9f0f4", "value": "jahan i danish book free download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66ccc96-7ed8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783960573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960573, "uuid": "8aae6ed5-d161-4983-a8be-05adef68da45", "comment": "Malware payload (Mirai)", "value": "9465ea9ba36a374985ebd274bc94a8dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960573, "uuid": "a3641dbf-ecdd-45ba-b7ee-16b44c0691c6", "comment": "Malware payload (Mirai)", "value": "d7dd32702818a06fe43fcc409ee34806348ddf2b7d756b1965ac5710192f18e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960573, "uuid": "de4e77b6-b194-4533-9363-7332d3127186", "comment": "Malware payload (Mirai)", "value": "7d0b2380bcb51f78c325d9b5e3b2ed3c4d55f4eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960573, "uuid": "77833eb2-3d2e-4bcd-bcfd-b0f58e6d20d2", "comment": "Malware payload (Mirai)", "value": "a77826cc9fbef6feb70a59894e48fb93fc560552337fe1edccc4c830e5a20cabc60737e4b6c6472973b15ccaf6fe06e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960573, "uuid": "3184aa76-a1ce-4b51-8ffe-07b9df98aa1c", "value": "T139135B86BB43D0B9FD5706B6057B93038632D93A507AE781DF25D831ED67600AB2B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960573, "uuid": "8c5d7f54-1567-425e-925e-a0962efa1b19", "value": "768:3Z9I6SALduopq/4gTZTLn8GI7rhY1hGMqsXd8VJvXj/pY+eLcSakIN:py61phpI/ArhY18TsXeJiHcSak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783960573, "uuid": "ed7b2674-0140-4c51-b4a6-5af1f2529970", "value": 43984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783960573, "uuid": "78ea50fa-db69-4ab6-b035-fcd3961a3ab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960573, "uuid": "14255d6c-a01b-4998-a006-afa7703b9a36", "value": "SecuriteInfo.com.ELF.Mirai-DJO.23686278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c259e563-7ecb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783954902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954902, "uuid": "c701657b-7ec2-4a52-b4f9-6b32427347ca", "comment": "Malware payload", "value": "3dfa88a5876f08aede7e4b1b49ba1220", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "softwaretech", "colour": "#4AFE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954902, "uuid": "1773c4d8-1854-476b-a4bd-59265b3a39fb", "comment": "Malware payload", "value": "d80b3a2b88e826e38c48b98c836c7a56b3968b497552ddb449a0e6bdfb6c03b8", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "softwaretech", "colour": "#4AFE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954902, "uuid": "a2921240-81f4-48fd-beac-ec4370758b89", "comment": "Malware payload", "value": "3aa01ecaa9d01a1aaa540b012081a37c61a562c1", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "softwaretech", "colour": "#4AFE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954902, "uuid": "1ab36988-c4d3-41f9-86d2-e0a705612edf", "comment": "Malware payload", "value": "3d98f65ad1fae49fa0ec301da5e4cab713a7a0275b7a84fe80a55d2f2d30cad80a16ba518e4ea802303866f6ff17daa9", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "softwaretech", "colour": "#4AFE25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954902, "uuid": "d64fb222-d08e-466f-a104-14b2f4dd7111", "value": "T18EC08CC033B372386F22C809B315869AF036ECC615884B58FFB000B2B2892E83006E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954902, "uuid": "f50b7682-dcef-4948-9127-59a41d2f5350", "value": "3:TKH/er/2DEcjISaXL2U+fcXIDK+IhvLuLMKYF5a6VK2bXLjnv2n:+Ycj3ab2U7IDKDTEMKY3a6VKyban", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783954902, "uuid": "dd07375f-14fd-4bff-a8bb-05c2e7158738", "value": 156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783954902, "uuid": "6e830a64-9178-4729-acec-f5a46a088492", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954902, "uuid": "26d5dae5-4093-43bc-a3d5-d2f8604544fc", "value": "_up.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649c60a3-7e96-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783931982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931982, "uuid": "1f132a8c-599d-46cd-af3f-af0933e5bfb6", "comment": "Malware payload (SalatStealer)", "value": "2ea79a634c56d40338763ea276e596a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931982, "uuid": "01cdce01-2a92-41e0-80a3-8d651e16b324", "comment": "Malware payload (SalatStealer)", "value": "d81d3e290d3e6f3f453a0e911069c95065ad52287bf2d46d4cbd12f268a423e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931982, "uuid": "c2aa1831-7fab-4ba6-8acd-950eef35b19a", "comment": "Malware payload (SalatStealer)", "value": "fe3f06c245b31847c1cbddfa747c384ed355ce22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931982, "uuid": "c4de0a1b-88f7-4bad-a06b-3c09830545b2", "comment": "Malware payload (SalatStealer)", "value": "9d78f860ca0ad07b6e9073d0afca9189722ef9b0348afceb3b43557a1f6b677afd9b4ce7ef8335ec007fc478d94714b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931982, "uuid": "378d5223-b97f-4859-88f0-508bdd6123b0", "value": "T134C65B01FACB65F6E9035831416BB27F23315D048B28DBDBEB583F2AFC776A11866245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931982, "uuid": "fbbd95cc-ba76-4025-aa34-b9249c18cf70", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931982, "uuid": "37905c97-3b35-4274-b1cb-39369774ed05", "value": "49152:4BLXAo0/3UUDP9QBRJbmG+Pc/YpMmHAM6Ar+PdK3z801Uif6a9Mzv34z+2jIunib:QAB/30JbRD/8eaziifcg8T4fVEY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783931982, "uuid": "516706c4-fa1f-4181-9767-0af32c6f32c8", "value": 12544512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783931982, "uuid": "27afdb68-03ef-4df3-9b2b-46ab13a0ca4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931982, "uuid": "aad263d2-0e91-4d3c-a112-10ca635e5b83", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.5067.13976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a338e93-7f01-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783977974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977974, "uuid": "94b1db2c-a625-4ddf-ae4c-075eb7b86dcc", "comment": "Malware payload (RemusStealer)", "value": "d7a90be977a8f4fd0889e7454faa7b10", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5231", "colour": "#4FFDA9", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977974, "uuid": "6909427e-2f41-4b25-8282-2b8e3ebdfca3", "comment": "Malware payload (RemusStealer)", "value": "d871b4706e6410c4170a03a86629822e046d81e15f6a50d905059d7f2383f1de", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5231", "colour": "#4FFDA9", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977974, "uuid": "9c42b927-3d5e-4f13-824e-09514b5e13f5", "comment": "Malware payload (RemusStealer)", "value": "0f9eb6fb312fd3501c973ef194102899a5c0f5b5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5231", "colour": "#4FFDA9", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783977974, "uuid": "b207878c-d655-4bd6-9478-3bcbe9e24d08", "comment": "Malware payload (RemusStealer)", "value": "e3edbdf61e0fb5bfa40fa981cb97c77680e5fcc4f92a58c9fbe4bcf1139045f3044f02681bcace609252203d21fcb11b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5231", "colour": "#4FFDA9", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977974, "uuid": "f8667880-5451-4776-aade-b06e5a7edbea", "value": "T1EA07335B7FB833C4E23C5A4739893C4BFC78DE4322C9E6960105A181EE24697CA6D59F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977974, "uuid": "14610c4f-ba7e-4e5e-a222-2f25111507ad", "value": "393216:Z01xEMIocb2SpCNXDJiuOsesooNvPVhXlZvYq+dQWm269ikaeW0:Zgbc/CNVksioNXVhXsq+Rm26aeW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783977974, "uuid": "39a8c284-38e0-4d26-84f6-2de0ab7f0412", "value": 17925859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783977974, "uuid": "8115028a-04c5-459c-b35e-253b7da47e63", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783977974, "uuid": "6362d51a-0bb3-4414-bbd3-6cf4ae01fda3", "value": "jahan i danish book free download.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c467070a-7ecb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783954906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954906, "uuid": "1d6814ba-dad7-4f07-ad38-66e73f55a8c8", "comment": "Malware payload", "value": "d07469fe2763ff32ef3eb0b757e16892", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "softwaretech", "colour": "#4AFE25", "exportable": true, "hide_tag": false }, { "name": "WatchDog", "colour": "#D28F16", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954906, "uuid": "d65fe25a-1bfd-4f61-a280-3fa6dd76d1bf", "comment": "Malware payload", "value": "d8f4dcaa026c262ee2f03e790fbc6c0eb2f60f9063bcac41d5b71dce24ef694b", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "softwaretech", "colour": "#4AFE25", "exportable": true, "hide_tag": false }, { "name": "WatchDog", "colour": "#D28F16", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954906, "uuid": "2645e376-47ae-4ba2-a6d9-2a87e487f036", "comment": "Malware payload", "value": "667ccbf45d5740d6ac4fad8cbaa176cd3fec8c8c", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "softwaretech", "colour": "#4AFE25", "exportable": true, "hide_tag": false }, { "name": "WatchDog", "colour": "#D28F16", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783954906, "uuid": "5ce7c718-a96e-4986-b92c-edd80c0243c5", "comment": "Malware payload", "value": "1bb487b73fb00ef9e5f5cf825df7d0eadcd269d7168bede8e2363ce58906a305226f1f935d36b9736e67a19322b04175", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "softwaretech", "colour": "#4AFE25", "exportable": true, "hide_tag": false }, { "name": "WatchDog", "colour": "#D28F16", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954906, "uuid": "5e323359-7afe-4b1e-a6f4-53e33e5d26d9", "value": "T1E052A672BA65D57638ACC22C998E9110392B3AEB36183458B4AD76043FFC31D51F277A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954906, "uuid": "ce328432-05a8-43f1-9499-82fe1ed7d44e", "value": "192:2875r4j74COKyAVF1mBt6e4egQq1GZ0HRit4Nmn5PH03/BNGBggGQd:T5tT4LyMiXn5PUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783954906, "uuid": "aacf28ea-ee2c-4ceb-bab3-a8af222a073f", "value": 13826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783954906, "uuid": "598eb4f7-9a95-4a08-ae0e-4e7e0652c8f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783954906, "uuid": "d2a8e7a7-d129-4667-bb38-68c75a4c4ebf", "value": "_up.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a572614-7ef4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783972337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972337, "uuid": "7f89797e-7753-4b37-9288-ee7f65478b4b", "comment": "Malware payload (RemusStealer)", "value": "3fa9ff04979f656ba3975f6ec98efcba", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972337, "uuid": "999bd157-f651-4d38-8aad-a55ea3f6d7d5", "comment": "Malware payload (RemusStealer)", "value": "d9824b3a6894de0606a03a23417f1c7e780ee0b5655f724dbfa455601e13eb8e", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972337, "uuid": "2356d440-eca6-4d14-b495-1ea5cc1504d9", "comment": "Malware payload (RemusStealer)", "value": "5203a18ead55b15a7cfba434fcdbbd7281de8fe1", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783972337, "uuid": "c2929fe0-8568-4f51-8abf-635b94cd6449", "comment": "Malware payload (RemusStealer)", "value": "ce1bd206deefe5a610675c8795b6c2381c5ca13d4bb16a274f7c5ef0646ffd4707d76c90a821f771bd8465a8d7d3107f", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972337, "uuid": "63e00416-fb3c-41c0-abd9-e9fcf57a1d29", "value": "T1C165232246E48517E6A40FF408FA42A30531BCE2577A91FF33C69D4C1567BE1663A3FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972337, "uuid": "d16576e9-cd97-4115-91cb-e9f286827692", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972337, "uuid": "f2cca5d3-9464-4a7c-a7ad-b316de1ab29c", "value": "24576:2vj0f+jhnPvPy/8tdGag0q3DAu/33bwRu+Yb6mQR5+b4qcNcjXT/:sgWjhX+8tdS0qZ8Eh6mQR56eaXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783972337, "uuid": "064050fb-fbe1-4b35-8b7c-81b138234d83", "value": 1467904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783972337, "uuid": "ddf6aadd-1a41-4339-90bb-dadf43fcac4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783972337, "uuid": "3c5677a6-445c-4d72-8fab-05357d918246", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f852a61f-7ecf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783956711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783956711, "uuid": "353b427d-76bb-4a4a-88c4-4774c674dabb", "comment": "Malware payload (XWorm)", "value": "4a5de22458dee5c7c9fe67d486f78a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783956711, "uuid": "10547cff-137f-41cf-8347-8e6d37ed4d32", "comment": "Malware payload (XWorm)", "value": "d99e59578c58923d0b56cfeb25bd14f60a7db8a47a8487bd22550035e39189e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783956711, "uuid": "babbe196-8533-4d9c-82af-504ceac7f308", "comment": "Malware payload (XWorm)", "value": "57f44e1a286d8a6ed0a046a5a5f6183cdb322f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783956711, "uuid": "d9a25c57-ce11-4ea4-8b2e-de777a407524", "comment": "Malware payload (XWorm)", "value": "e36eab42e28d7d42658d277e2391a91657ef74d7b343025ef47992bcdd92ef79c5b07c637eab343d3c7a0f570e7214d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783956711, "uuid": "9003ec6a-c5c6-4422-8f80-0b531dda2620", "value": "T11F757B229FB43E20D43337048F4DC5F19CA2AC69896B65363776D4CA1ECE929197EE31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783956711, "uuid": "4b37cac7-349d-47cc-b0e2-2038bc1e2293", "value": "1536:6ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccn:l+jBmhngE+uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783956711, "uuid": "ab8ee799-a08b-412d-b9c4-40a5856167ad", "value": 1658841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783956711, "uuid": "58f445ae-d628-433b-8240-637fc4144ed0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783956711, "uuid": "915b9e90-6eb0-42ac-9625-44df03a39d78", "value": "PO_47W028051.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ad109a-7f13-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AnyDesk)", "timestamp": 1783985755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985755, "uuid": "d3091e3e-afd5-4a8a-aadd-beada41c53ee", "comment": "Malware payload (AnyDesk)", "value": "da3d9a45621fa28b45e1d5b1f0b9e326", "object_relation": "md5", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985755, "uuid": "acf1288e-0399-4ebf-b8f2-cc77cb47721d", "comment": "Malware payload (AnyDesk)", "value": "d9a2381a471f6c93606f393561c4aca8568313f1d992d9973b7d97821b37ba2c", "object_relation": "sha256", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985755, "uuid": "f5ed2ce1-c5a1-4211-ba90-6e79a45deaae", "comment": "Malware payload (AnyDesk)", "value": "0966650e7bd62bce926142f51deba6f81f8078b1", "object_relation": "sha1", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783985755, "uuid": "8360f973-2ce9-4158-91da-8126cd629047", "comment": "Malware payload (AnyDesk)", "value": "595148d30209983561e87a3f0474b6f9a4330d4a862e7a5ef43ed670ffabd505ebf078c4de87ed233cd6ab2a3aff7be0", "object_relation": "sha3-384", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985755, "uuid": "4b737d9d-24a3-47a5-b080-c696248fa73b", "value": "T127D6233FB28B303EE06E1A7A3672E210953BAA61A5178C57D6F4C44CCF154B11D3EB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985755, "uuid": "c4f094f6-8017-4ef5-b52e-270c21bb9e90", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985755, "uuid": "8595a6b5-ff50-4e4b-a360-f5b548487235", "value": "393216:0til1h22ExhnFJly7ROyPFPXww9v2J77G71sms:iHTs1OXiv2J7a7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783985755, "uuid": "9f46cf7b-6226-4f6e-b2f0-fef7eb827de8", "value": 13534305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783985755, "uuid": "115d7b9f-cf38-4124-8770-8bfe50ab57b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783985755, "uuid": "758c629a-c604-4309-b0dd-23109b9e290a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126b4174-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963197, "uuid": "0d5f9c87-aa05-430f-8986-9d9ba4091fcc", "comment": "Malware payload", "value": "2efb5e9fa018fad5bf23d1ffdce679cc", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963197, "uuid": "b92f4f3d-bf80-48cd-96cd-247f61aa05f1", "comment": "Malware payload", "value": "db003e402d882001c2cecc9a71c718ace2c4a6d61fe8e2915af73ebbc70d5d3b", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963197, "uuid": "6bf879fa-190c-496f-b438-e4e181e6c3e5", "comment": "Malware payload", "value": "d9fc9e38fda83fc9e5251c08f2fb2ba70d8cfac4", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963197, "uuid": "0fa6c1d2-ad33-49ac-889d-05b741e3a721", "comment": "Malware payload", "value": "e6e42bb0c8e7ba3f0b031e4d80de41e30e26f8d89f71a4b8ad20f3a3796d6523f8e33919c84ab856fccc5f53ff94ff02", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963197, "uuid": "0f0a9ae8-7a4b-4cea-92a7-ab7afe37cce2", "value": "T14B252315F6EEE722E17642390CA9D44E5B9EFE58B73EA10B31A4330C2675B3E314E425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963197, "uuid": "2d6abe56-4611-4cca-a17c-17b01f71f3d4", "value": "12288:/GfwI82f2Q7TezN4ee+KahN0QwKF2UElH7k1kyaNsUrS/WVQl6QsuQmdGc1iCLKe:ufwI/uweR4eNK1QwKFgEmQs3sGc1ibr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963197, "uuid": "628779bd-7a4a-4558-9441-b935206d11ee", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963197, "uuid": "fd279388-1d16-470c-aa78-3247a1145a75", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963197, "uuid": "23c77509-69dc-4dbe-9b1a-444d5a2cc92f", "value": "Techno-Commercial Bid .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287a65c9-7ec3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783951208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951208, "uuid": "db4faa5e-eb54-457b-953d-08f7e28156f1", "comment": "Malware payload (AsyncRAT)", "value": "51a320f03e518b6993dd8365423a6663", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951208, "uuid": "6c20503a-f385-4c62-a62f-91dc5017e0d3", "comment": "Malware payload (AsyncRAT)", "value": "dc14aa1d739c79a92ae7342a7f6941aab24df1b03fedd0a99d9a57cd972d569d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951208, "uuid": "f74e995c-a7e4-4487-93d0-a680e14309f1", "comment": "Malware payload (AsyncRAT)", "value": "2db819909f6e9406e173455e5dc7db6c41658da7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951208, "uuid": "53ba08bd-f1a7-4b34-84fb-f2e2c91b0340", "comment": "Malware payload (AsyncRAT)", "value": "587967af905b677eacd5a21e4aee9215ee522194646436f4628a647d128ad471827695fd872786364027b8d737de655f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951208, "uuid": "68181752-a53f-457c-8f18-9f3316ea7072", "value": "T1CFB4D1005BC07A6E0BA81B3DB12F65EEF3910E8528556DCAE712FC465BF6201F6B7178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951208, "uuid": "967edc08-9264-4f5d-92c4-e303de527aef", "value": "12288:5kL1ciFeZKqZIe2uFos5cB2BKmCpb1swpF:5kL1/eZ7F2soZBNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783951208, "uuid": "0b8cea3b-953e-4f54-8ffb-9758c52187e9", "value": 538550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783951208, "uuid": "a355dcbc-ccf7-4b9e-bed9-fce768a666a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951208, "uuid": "378e2277-2cee-4b8e-ae5f-d13de9033274", "value": "01RFQProductListandSpecifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dd10ee-7efb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783975499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783975499, "uuid": "0b7363e7-8cd8-4119-8c04-d090367e9ff6", "comment": "Malware payload (Stealc)", "value": "e82a85c73e02ad9fa4d8e5d60c2e8be4", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783975499, "uuid": "fc9ef4d6-8f0a-4e52-a72f-92fb06e4746f", "comment": "Malware payload (Stealc)", "value": "de561c4a3b59f0351d866721a5a204bb9c1396f5a2b4d9140f7385b0c2ea102d", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783975499, "uuid": "2d2c6925-6f26-43b5-82ff-13d2f59b8e93", "comment": "Malware payload (Stealc)", "value": "c0b978b82ab3159467feaf61bee001381317e75e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783975499, "uuid": "7497632e-19a5-499d-a706-6e043d149d6f", "comment": "Malware payload (Stealc)", "value": "cfe9303e91bed8aa319768dd52dc9bf4c6d72d1e021c88b7d5ae99f9632cb1bbe1e75260d724efa8bde326d03b3fbf34", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783975499, "uuid": "a7e0979c-1f2c-471c-9044-0562ddc29d25", "value": "T1B5C57E01FCD349B5E802323259E7727F7335AC051F399B97DA547EB9AA3B291182B309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783975499, "uuid": "08cbfd70-42a9-48a8-9a6e-8ede54b4f445", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783975499, "uuid": "884e2413-3beb-4b02-b54a-de234c3de8ce", "value": "49152:UGrnB4Fm4OH8v6nAxWlhIZHeOYP/gbsHM3z:h94FuBlhQH4PDHMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783975499, "uuid": "b0c9552e-57f6-4246-b69c-8107d911a697", "value": 2573240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783975499, "uuid": "e499827f-1b97-45e6-afc4-c86e6fef601d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783975499, "uuid": "a23dbd05-c6f6-477f-9461-af9d714ea727", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e2b8bd-7eab-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783941112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941112, "uuid": "68582ed3-1bd5-4c6b-91c1-a09e36a1805c", "comment": "Malware payload", "value": "95177ff81af260caa01f8f3a7b77bfff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941112, "uuid": "017a3647-de31-41ed-b388-7825f9d184bf", "comment": "Malware payload", "value": "dedabf845427e3983739ceef739528d80bffd209ca1a6328892dd169385b5d4a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941112, "uuid": "66970967-1381-4d8a-b25d-34317a1554ec", "comment": "Malware payload", "value": "263720bb9a8bc172034c60296474756a5c45992c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783941112, "uuid": "85a36451-531b-49a5-8a34-e004ba3831ae", "comment": "Malware payload", "value": "e9849522d2bfd107fd30e5e85fc9bdd1691a4c48efcccc19cc5a328ba2f79217f78676b87a17335198b08f00c9b9fdb5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941112, "uuid": "9d2aa098-547d-472a-9637-638ac411caca", "value": "T1B60512B5ED197DB0480EEA7AF01B7E4EA3181EF7C91FE19402BE92D5063BB51232D452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941112, "uuid": "c00bfe93-2079-4228-bc03-ea28783ebf38", "value": "12288:Sjhi7VmkXa8yuqjS4rCqjTndrQKK/b0M7vALjEKHeStHHs+nM0t5t49kpq3G:SjYmkXaGsjTnd6AMajE0Bf14G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783941112, "uuid": "1f994802-7e8a-4bdd-aaf3-6ce5d2467421", "value": 840035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783941112, "uuid": "6c797b60-2c4b-4a65-b41f-e8904e556c3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783941112, "uuid": "b4fd9833-addb-45af-8479-5c58b36e0d86", "value": "document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0af8e68-7e8f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783929130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929130, "uuid": "51e40d3b-c670-43bd-9a09-ec719d7b8188", "comment": "Malware payload (Efimer)", "value": "78888c75aad641e313d913135dccffd4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929130, "uuid": "12f4bcda-22d3-43c5-b385-3c76469adcdd", "comment": "Malware payload (Efimer)", "value": "dee387cc48f94ec7319a4e22e818f8bfd336ec576a5ef15e1e60a7bbc521c074", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929130, "uuid": "298bf2cf-aab5-41d8-befc-343dfee3cb87", "comment": "Malware payload (Efimer)", "value": "fa2eaf1958048a9b998d7bb011a5098d9b2a7a42", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929130, "uuid": "b6e510bd-5d58-4c4c-990d-e91c2d71a81b", "comment": "Malware payload (Efimer)", "value": "cda7cc889dbbb091c1bebef9373b4385198e7173da99d4f4896085d6394ed3bd8ea9b5ad74c6a72d871ad8d29c53ea01", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929130, "uuid": "1becccd3-78fd-4e53-af08-e057194d7cb0", "value": "T110E633085AD012FEFEA3517EEA91559EE436B0B14BB2DEDF476483A07E871C04C39663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929130, "uuid": "914f4d5a-bea6-4ae0-a341-7c0a976b8358", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929130, "uuid": "6bb70f31-321e-428d-a1c3-5beb3b430a87", "value": "393216:2fod8eKCAF2zvWPs93mSVHXMCHWUjXEcuI3/PGTAI:2fstzvWPshmKHXMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783929130, "uuid": "3a77f5a2-7b7e-4469-bafd-9786998ce73e", "value": 14316914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783929130, "uuid": "63a8fdac-b6eb-4fd7-b466-9c7c58630de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929130, "uuid": "7809f11c-10ed-4190-bcbb-42807caaf918", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665086fc-7ebd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1783948735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948735, "uuid": "6a724cee-ee59-463c-879e-01afdd134b67", "comment": "Malware payload (Gh0stRAT)", "value": "1aa9416b733743f534abea90982dcd16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948735, "uuid": "05d6126b-5c46-42a9-b160-68400e6328a8", "comment": "Malware payload (Gh0stRAT)", "value": "df603ed55cbf6f9d74068b956ab966a7b785eb102e1045f343d96255eb2cdc24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948735, "uuid": "a0d704fb-637b-47ed-8b87-6ccc7dfdbabc", "comment": "Malware payload (Gh0stRAT)", "value": "5f283f5a5eb22bfeb153756a81728bf5d5c6ee71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783948735, "uuid": "5066c350-270a-4202-9cd9-606017a75502", "comment": "Malware payload (Gh0stRAT)", "value": "215b73c6fc6b11146ad33cace3913f9b4c3202a100c302effb41456571aae197fdd937efac75de022302087201453d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948735, "uuid": "b9216f0e-40a4-4a20-bba9-15873d14b76b", "value": "T171461253A18F563BF07E8AF60B76D25E55377D22A5024C66A2E4389ECF650C12D3FE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948735, "uuid": "286fbd02-a4d8-42df-978c-5cb7cb65d534", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948735, "uuid": "cde0c9df-d516-4bd3-9bf3-c2431934ca8c", "value": "98304:Q5fgQ+ynY8U1qZcDkGHnPEqsXPVJWvI2fpta9dTEaIJzQ:ob+ynv+AGHP6XP4I2fHaHIbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783948735, "uuid": "118dfbdd-93d7-4f16-94d5-38d3b6415606", "value": 5487909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783948735, "uuid": "28e45853-0180-4142-80fc-185f5e3ced91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783948735, "uuid": "39e850f5-7fa9-4be2-aeed-8d8714269716", "value": "QuarkPC_V6.9.2.881-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e105c758-7e72-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783916729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783916729, "uuid": "0ca60549-3e65-4b51-8b61-732f6aa88cd4", "comment": "Malware payload (Prometei)", "value": "f9f7a4c6d495482c973dcf2ac554a74d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783916729, "uuid": "26b408cb-3cb2-4d6f-b372-de50acb2ba88", "comment": "Malware payload (Prometei)", "value": "df719ce7c80a625bced0d141cbccae54650b14c56c3b7afc06afa0fb8c30f72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783916729, "uuid": "6d2ab518-fa01-4f8f-9ae5-fc16cce4e6d0", "comment": "Malware payload (Prometei)", "value": "1aec369219a550a9db2628a0433620a7cb7115a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783916729, "uuid": "61c184b4-4da2-4f08-b7b9-5b389409d432", "comment": "Malware payload (Prometei)", "value": "554195947feae18b768854bf6535f11efe7aac40df4b22821a7e65c5aa8d9cf146a2be7b27d11833219ec2016f34d8c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783916729, "uuid": "db60539c-5ad6-4df4-bcef-27303554a8b1", "value": "T12474C07775B8F15EC88517328F62C7C293993F908993806F7EB4530F29278A91A35B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783916729, "uuid": "be352980-77a7-4aeb-a3f0-8cc274d22a59", "value": "551920a564f0da077e7c568c1940defb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783916729, "uuid": "e7a438e6-e980-4691-94fe-9fd912edcea4", "value": "6144:8RzeTJQJfChxxTnECpq9XkCnNNCoo/iSq9opz5Pv5Pi12dwyN:8JZJfChLjE4q9X7HGqZ9opzvi1yN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783916729, "uuid": "1bc186e0-17b5-4968-ba60-594fed31e86c", "value": 342383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783916729, "uuid": "4ccf984e-79f6-49cc-97a0-97163f45f61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783916729, "uuid": "03a50679-7272-4bd5-a2a1-b68dbce7d54c", "value": "df719ce7c80a625bced0d141cbccae54650b14c56c3b7afc06afa0fb8c30f72e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cc10dc-7ea5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783938453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783938453, "uuid": "5397001c-9b0e-455d-95a7-bae2e91136b7", "comment": "Malware payload (AgentTesla)", "value": "b37be219da8a660bd8b5a5358f369c79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783938453, "uuid": "4323b180-77d5-40e5-a7f4-6ae06ef812b2", "comment": "Malware payload (AgentTesla)", "value": "e059c100a917af58168b1e63ebe75cb4558ec144efd91f1ecb145bd9ad79529e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783938453, "uuid": "7a9d4bc9-050b-4b8f-9eca-4c92de4031f4", "comment": "Malware payload (AgentTesla)", "value": "ff59400c7b2adf6ad59daa3c26854726473a366d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783938453, "uuid": "918377da-8b83-4fbe-a6c1-85fefa7f66e9", "comment": "Malware payload (AgentTesla)", "value": "db97fbb63494461ccdbc78474eab19a7516e48e2938950210b110e77910ddc20f28071a94bf91df1a118294506b6fc28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783938453, "uuid": "83ecc9d6-8276-45c7-acc6-317db1a3a262", "value": "T1273533D9E16E54AE7F10D332CF1C3A941F0629F1ADD6122677608BBC7E27A533A87481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783938453, "uuid": "8e715a50-6ee5-43fe-9290-93dd1872b2d2", "value": "24576:yO4xtSeSgmdCPzNHZyItDh5iosWD6HlzYWF+oCM8LQQawwrlOPU:VKSeSgmCZNhAosWDP1oiNaHQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783938453, "uuid": "6f9b3643-8bc8-46df-a412-594344b70392", "value": 1129335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783938453, "uuid": "cce3f181-f062-4d12-a722-cc6b298adc47", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783938453, "uuid": "305dc3e3-95c0-4680-a309-64e11c239770", "value": "Materials to purchase.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfbc429-7e7e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783921930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783921930, "uuid": "c0801d24-e50d-4acb-857a-dddd3ec1ddb4", "comment": "Malware payload (Efimer)", "value": "16343d2642d1e5b938fe5988664d98ca", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783921930, "uuid": "92689ad5-70f9-4cbc-b2c5-af8f6d73a80a", "comment": "Malware payload (Efimer)", "value": "e05f0a5fb139c75d51fefd5cb1c4346ca044f8f777e9c6b7e0f4dcdd7e00bc72", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783921930, "uuid": "f1b9a11d-cf6a-41d9-b7a7-4e5a10ee7b40", "comment": "Malware payload (Efimer)", "value": "cd5dd6ded5285ccc3d97301a352712c9d760beda", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783921930, "uuid": "d763ac19-7231-40fe-8b26-85c1846f2e61", "comment": "Malware payload (Efimer)", "value": "f42f1da0e07172fa4aabd891370d5d64c1ca4599db442520017900a490457dc99a73e16ad6223c128ddcc41d7c5660a7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783921930, "uuid": "610a4f73-db20-4f59-b2d0-40fc17041e7f", "value": "T1ADE633049BF016FEFAB3413DD8E21A99A5A5B4B24772CDCF477447329E272E1493A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783921930, "uuid": "5ce00a5c-0613-4126-8568-75b6559b4aa8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783921930, "uuid": "236a94f6-f6af-465f-9baf-45a7224bb1f3", "value": "393216:1msWfnHPnIwwrp9FigbWMXMCHWUjXXcuI3/PGTAI:13mnwwg9U9MXMb8XsH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783921930, "uuid": "332e8d33-19fb-4cfb-a7de-8e516464346a", "value": 14285284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783921930, "uuid": "0de32e68-6bd5-4991-92f6-ec4b0fb8501f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783921930, "uuid": "68fb558f-c10f-4f25-89c6-4e54a3b55905", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca2914d-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963187, "uuid": "1349713c-22b3-4a31-ae55-48bd30f4ed79", "comment": "Malware payload", "value": "2adcf20a49a49c6c94e87061e00add8e", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963187, "uuid": "28ff13d2-90e8-4e9d-b311-c5523b6d7dc0", "comment": "Malware payload", "value": "e07deb08df3c95c9121b82da8e126235e5d7f0f4a391d428ed9a8ff43b42ce35", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963187, "uuid": "c381b3f7-1306-4e47-8984-ad7e853b6735", "comment": "Malware payload", "value": "eba49db0c6aef9a0aed8cbff1191ad8f38551b8b", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963187, "uuid": "3aa6ef6a-c2c2-4769-87b7-0a264d11b90c", "comment": "Malware payload", "value": "de0756848d0ece1ea056b0db83c2f018c6fb8300c6f700d35750b11ea2505e8cc8444cb680544605f8602053a7acc66d", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963187, "uuid": "85fc12a1-c6ea-43bf-a906-f25ddbdb7a48", "value": "T1FAD25D24336AC205E9828D754DD4D2DF6B21FC51AF96CA0B32C5B72F14792D0E963B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963187, "uuid": "e001732d-66ff-458f-a6f3-c60d1ce61263", "value": "384:01e/VMRJmgruVB/E2Xk0jRf2dHfiDWdpsPXempvjJkNXv:0aMXmgG/E2U0jRqfimCPumRjJkBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963187, "uuid": "8c46dfba-0436-4972-aa88-63ae7d332bee", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963187, "uuid": "78bdbc2a-e344-47c3-b780-5b2eb3666381", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963187, "uuid": "3f2cb3a6-c368-4679-a90c-d9ee9ed5ee4c", "value": "PL_VTS573959595993.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8d8eca-7eb1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783943456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943456, "uuid": "fd76f7ee-1052-470b-ab8c-ddc000e376df", "comment": "Malware payload", "value": "09aff59946b5dd035ebf238821c4cd64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943456, "uuid": "9497ae43-8704-464b-b400-32f0eecfbaae", "comment": "Malware payload", "value": "e13d3152d522fe7ea494ea8d85ff5391ba73c76f520e38f1993c106d1de72054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943456, "uuid": "3414dd33-0589-4ce2-95ef-91ebdcbfb14f", "comment": "Malware payload", "value": "b0e3aa78fd2d4c568bed425220089095937c0a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783943456, "uuid": "84ac351b-c5b8-490a-abd5-87f78dd4865e", "comment": "Malware payload", "value": "ddcabf6ccce285c9f9516bc42b1844201c976b7dc12fbdb8986cd300f3f2091aff9581d0d4b8d5a08f4a075f761b2b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943456, "uuid": "c75bc20e-cafb-4a27-bd4b-eece83ddb7bf", "value": "T13035331570A1C8FBC2D2873D83CD9B38B9A9BD8F00B4A4D5F8A09E1D525FB70127959E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943456, "uuid": "75b68718-cf33-48c2-a068-c81082096630", "value": "8447480e2cd13529de880ad35ebaeb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943456, "uuid": "19082e1a-2f80-4f99-84c6-524ed2833f5e", "value": "24576:0aZm0S/Mpy3PEOJCEGnLuH58Z1tbeN2r6sfyjoB8Y:0aC/IycOp4iHcuDKQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783943456, "uuid": "ff15aaf9-5196-48ee-8fdb-985817e56227", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783943456, "uuid": "7173532f-75ca-4610-90b3-1fdfea34b953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783943456, "uuid": "caf127a8-a1d0-40e4-8c8f-c461fb10df74", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a539bd-7ee4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783965342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965342, "uuid": "cf9dad35-fead-4acc-8266-7439eab4a0f3", "comment": "Malware payload (AgentTesla)", "value": "f819085335563edecd178db684bb31f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965342, "uuid": "d6eb222b-7881-49b2-b24d-8bbef213f916", "comment": "Malware payload (AgentTesla)", "value": "e168a23711f5c8cd4a1039c5da8b430636414145083bc1e5a4bb283f96f3492f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965342, "uuid": "1a1be230-36b3-43a4-8585-1d56c14b0465", "comment": "Malware payload (AgentTesla)", "value": "10a19fb8ce8fc8a9a4827ac773ab67115ddbe899", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965342, "uuid": "903ae625-ca44-45c6-8ce0-ff21f5e9e387", "comment": "Malware payload (AgentTesla)", "value": "06b665a7dfcffd8490a6f1cb98a7e85cdb109e5882c54ca1932c9cb668cdaa83e8ab7f5f238b86fd1d9177cc948a6840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-4bagh-net", "colour": "#04FDEF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965342, "uuid": "4aa4a1f5-ed01-4585-9566-99b7bf3b482d", "value": "T1DC25335479742F9B1CBA325DDF22D37A186FCB9510970833266D2B2EAEC731B901D18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965342, "uuid": "829e6617-8e8f-4186-b604-bb1467d02625", "value": "24576:7VZY08ZtE6TiYj38dQ9Dz/wNvb3bW3gZtqNDYb63UIqJ7D5Zf1T:hZ78c6eYD80DbwNv7bWQqiyUJxDDfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965342, "uuid": "9f722ad8-2f18-4342-96bf-61f1f7e430b4", "value": 992933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965342, "uuid": "2ff7cd26-8b74-4da4-ae50-0310e9f554d2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965342, "uuid": "c959ef97-0d48-4bdf-ad9a-bc33df759899", "value": "Materiali da acquistare.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242d0350-7e58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783905245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905245, "uuid": "85f3880d-92ae-4fb9-bfcc-6ac8580c2856", "comment": "Malware payload", "value": "946c5058010f3ab0f6a804b448d74a62", "object_relation": "md5", "Tag": [ { "name": "193-143-1-131", "colour": "#E80267", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905245, "uuid": "9b102a09-a854-40bd-a95d-34b4be066ced", "comment": "Malware payload", "value": "e1d2d20089aac539b2d1fd32569cb0681f5a31db9575d6ceb53f585d0961b4fd", "object_relation": "sha256", "Tag": [ { "name": "193-143-1-131", "colour": "#E80267", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905245, "uuid": "00d0c802-75fc-4377-bed3-dcc4e960f45b", "comment": "Malware payload", "value": "16db9b07aa2845942db2944f0a1605d5203c5d46", "object_relation": "sha1", "Tag": [ { "name": "193-143-1-131", "colour": "#E80267", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783905245, "uuid": "766187d9-8dfe-44cf-995a-3cad5e4bfbc6", "comment": "Malware payload", "value": "43331246014a43643038a3a608c29a3055262a22ec941cdfdc2f5d7b33ca07e5a888feb1c0915ff7b17bcc8f1f974139", "object_relation": "sha3-384", "Tag": [ { "name": "193-143-1-131", "colour": "#E80267", "exportable": true, "hide_tag": false }, { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905245, "uuid": "ed34be92-0d51-4abe-b6e5-2cdaaf822559", "value": "T151B60773644D32CF48920453E512A0F38CBEE936A71A92E5D48B902D39EE0ED956FF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905245, "uuid": "cf389b08-7f80-48f4-b58e-2cf4fab2b2fa", "value": "47907213b5e9405955eb9c17fcfb37db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905245, "uuid": "08df9ea0-6da4-46e3-93c3-e2941522d72b", "value": "49152:AjyfRbOmE9IvPSy2aWMp14Pz9YwrFWfADxE2vo8MVQ9se4wFI3OMaswuqq9N9ePN:AX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783905245, "uuid": "cbd5eaee-c83a-4c21-bb8e-28c37b960e5d", "value": 10669376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783905245, "uuid": "65a0413b-5a1a-407a-92c9-37342b9b9559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783905245, "uuid": "31a169b0-ca66-45e7-bc55-f96cc51a0c62", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a9799c-7eb5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783945540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783945540, "uuid": "e2b9da24-dc19-4875-8c61-acd8594bebb2", "comment": "Malware payload (AgentTesla)", "value": "2b068a1c91bf23564ad0586ab288d4cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783945540, "uuid": "4c8bf1ba-c10e-4165-8681-6c69d5a6f6fe", "comment": "Malware payload (AgentTesla)", "value": "e27635938dc0d6bf3e4fb68dc99e05835e6525686a3273d3f4a744ea02d1e086", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783945540, "uuid": "04e407d1-c5e4-4601-b9c6-a33bf6385d58", "comment": "Malware payload (AgentTesla)", "value": "6746c57b0d1bf6e8b6f93e2e6b7cb88274b44ce2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783945540, "uuid": "6ecb9957-150f-47f5-b5ab-50eb72e6a48d", "comment": "Malware payload (AgentTesla)", "value": "33c843da4012a7b7407d7c15785b93247f910a20756d2b985c44e18a2a4fc7e20fb424733ef3e7fd04fc0ddbfc2f46ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783945540, "uuid": "941f01ea-60a9-421d-940f-760b428b0b05", "value": "T1F765F10056C0AE6C57EA5F2D71BF718AF6E10CCA5451A84EFB22FC42FEFA205D9121B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783945540, "uuid": "65f29ac9-8d51-46cb-9781-def6d68c6a7d", "value": "24576:QD4++P7GqmDsgFC6ehji9ddWafOd9UEjzb3k+mu+g:ntmDXs6eZi9dsXbaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783945540, "uuid": "fd1953e6-5bef-4e47-bf70-94fac62e5e77", "value": 1488934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783945540, "uuid": "78910cdf-f09e-4aea-8233-f4c1dcae6964", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783945540, "uuid": "d493fe41-e391-41fe-8953-e84671f3611a", "value": "MV CHRYSANTHI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c04a995-7e57-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783904990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904990, "uuid": "fbe1d0ed-36e3-421e-be71-8c44862d216d", "comment": "Malware payload", "value": "5bc9f0be8f29570a7699b5ba83cf0943", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904990, "uuid": "0952d6ca-12bd-4b98-a1bd-f1934a31520d", "comment": "Malware payload", "value": "e27696135b673b817709e2cf6309ad0ca23e81080795510116a8c23325399680", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904990, "uuid": "08c505fa-e661-479c-b546-43fcb4f764cc", "comment": "Malware payload", "value": "5c2e4a5dd458cf86ad941c8ba80fa4bf21a3f2eb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904990, "uuid": "fa4f20ae-b90a-4d6d-93ea-cd8ef23159bd", "comment": "Malware payload", "value": "30998c0e8aad597a12821bf2ddbbc03ba9e8777712498e388351502312977b3705974e95d7821128a75fce5132001847", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904990, "uuid": "260db606-3495-4f7f-bfff-8096d3bcfe22", "value": "T1CA073343D5A20F59C52D213845EB0F47ABACAF0A8525671E2B64E36F7EFB3F0492C116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904990, "uuid": "d89ded32-ed21-4714-ad60-44898c49263c", "value": "393216:JFSEJXihskJE3nxdDpaZ0BIUrREwkE6+NmhVjPdmhZjWvpn6cN4pfStQapCfAE:JFSSgtJE3nj1a2BIUrREwkV1go6cqfJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904990, "uuid": "33270948-433e-4682-979e-7b357cc58010", "value": 18077860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904990, "uuid": "33d2753e-fbbe-4196-ac70-02ec46ec431d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904990, "uuid": "a83874ca-f8c9-4775-bef8-0a98a51fa4c3", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcb7ddf-7e93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783930551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783930551, "uuid": "c3cd7d05-fec1-47a6-ae99-2b074da4862e", "comment": "Malware payload (Formbook)", "value": "132892cd5a5a59ab26cf37f2423b3d63", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783930551, "uuid": "265cb2f4-c192-4d7c-8165-fd8afc479c53", "comment": "Malware payload (Formbook)", "value": "e3ee5d56ae3281d15eb73228e5cd94d955b4f664ac73de9651a16d034f32c93b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783930551, "uuid": "da8632bb-7c1f-45a8-9713-bb2cd47f5029", "comment": "Malware payload (Formbook)", "value": "23e0ccbc7ff4768198fbaba784377fea28602159", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783930551, "uuid": "704ae680-3c45-429c-bd55-dfc030a8063e", "comment": "Malware payload (Formbook)", "value": "2c85b33d88aeeb69d369e18827f2e793e566b5862b5d1fc67115d9931278f14084fb5ac1a88db4a22c43f909836e1121", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783930551, "uuid": "efbfa135-71b1-42aa-a63a-358c0b98b62b", "value": "T1554533508B1D64320F05D36816070E2717D05E46E919EBFDB39DB0FAB69E6239E0B1AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783930551, "uuid": "33855d36-46de-47c4-8952-531b2a43f1d0", "value": "24576:3Kj6dX8yBRqIZ96agqb8jf5HGrxUi8ulzZ5B7pfYk4++Xh27Ksqy3T:3dZvxgqbIf5m3fpd/xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783930551, "uuid": "434b8aa3-87ce-4e3d-9f52-2cebe077f929", "value": 1278503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783930551, "uuid": "e47d9e15-46ad-483b-b0a4-a585a16d0f7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783930551, "uuid": "390fbd82-c76d-4264-8f18-2854a5c9df05", "value": "RFQ-62924-0187.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3be0cf-7e89-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783926550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926550, "uuid": "8bbc3f18-661f-4885-b03f-fef4b51c9ea4", "comment": "Malware payload (NetSupport)", "value": "6806f692a7570b02d3b431e4b3d36eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golzap-com", "colour": "#2BD9C5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926550, "uuid": "dee0c770-fe27-42fd-8255-1e3779f01b4a", "comment": "Malware payload (NetSupport)", "value": "e66c91698d499c6f4ec6c8a48f5fd11acb87ff2bfd45abcac6684263d879c37b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golzap-com", "colour": "#2BD9C5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926550, "uuid": "4e46691c-b0b1-4c59-8adc-cc374b25dac9", "comment": "Malware payload (NetSupport)", "value": "3ef5c32fd39a3b2a35783b162d39b978ff95729c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golzap-com", "colour": "#2BD9C5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926550, "uuid": "1c569f97-5c88-4027-8169-3c3fcb824365", "comment": "Malware payload (NetSupport)", "value": "53722f29b4b77bc16f57b62d6e87d0365098a5c4cb519c970558e5bf88f791843d64cf246cce26d13d1b1db6921bd176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golzap-com", "colour": "#2BD9C5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926550, "uuid": "66515e7d-73c5-40ff-b703-db81c2185210", "value": "T101D6AE21B64AC53AEA6E41B1596CDB6B61797FB20B7144CB73DC39AE0F704C21232E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926550, "uuid": "2d9bf46c-654a-4076-9962-327d5006c5cf", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926550, "uuid": "f58ef406-97b9-4973-858c-7f78bc951b3b", "value": "196608:f9upko8Rr6rwIc3LoyZoWy8WBWjeCaTy9lvQ329q0t2:f9/o8LIcboIb1jXgElo2s42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926550, "uuid": "27dc9905-37bc-4565-863b-4273fd0579ec", "value": 12819233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926550, "uuid": "4c87dfc5-e78c-43a5-93ed-f86456e601fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926550, "uuid": "9863a5f3-d6fc-471f-8a14-a6b2250aac28", "value": "e66c91698d499c6f4ec6c8a48f5fd11acb87ff2bfd45abcac6684263d879c37b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05da7658-7ea1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783936547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936547, "uuid": "eaaf4613-e7fa-4a0c-a019-6813acf57667", "comment": "Malware payload", "value": "12fd8692af16a4500706a333487571cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936547, "uuid": "191d6147-c864-4e36-a328-25178879e0f6", "comment": "Malware payload", "value": "e751d7b5e521b7a544cce47a50094e46226f842014ff0ae7ac0e249bf83ef4ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936547, "uuid": "face9968-9417-43fa-98fd-64622f256165", "comment": "Malware payload", "value": "a9e124a6bf6ae7ee4264ddaaebfefa41e811c589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936547, "uuid": "f73ff055-6a38-4093-aee9-006091162ee8", "comment": "Malware payload", "value": "687e88601c3f505a5ef9b39dec7a0a3dd57563ed6b5934a5b37bf23358f48491367435e004630c876bb292f3862e1534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936547, "uuid": "ee01feba-fd10-4643-a2c7-91c80ce1e445", "value": "T11F174B47E8E21DD5C4EAC670D12A826BBAA13C091B3823DB1AE0F3741F367D05E76B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936547, "uuid": "a5a112fa-c87e-4c35-b57c-03fbbc40fb0c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936547, "uuid": "a9b6de0b-70ef-4448-b28b-5b5ae958d8bd", "value": "98304:djDGTun+0g2OIT4NFTzdQ+Ozevp+Vx78xprFYRZHmSOvI9olwheS8bSmkx:dOY+N/IATZ9xvYe9FYRQSt9oldja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783936547, "uuid": "c140a3eb-8e65-4787-8362-69e05d87b724", "value": 18488832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783936547, "uuid": "df233b18-cdec-41ac-b4b4-73358acfcde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936547, "uuid": "52875407-9eda-4944-86c4-f46235168edf", "value": "12fd8692af16a4500706a333487571cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ff47a4-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963230, "uuid": "145d7aa9-2a8f-46b2-a033-fbf6e4faf0d0", "comment": "Malware payload", "value": "bbc9371a782cbc5f431d2467076e11b5", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963230, "uuid": "03afe1c9-3943-41a3-ad6f-9b02f8e6ddc6", "comment": "Malware payload", "value": "e79711f2b02132601432b376367c036bb7fc9298acb7eabc3216cc9ad2b10462", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963230, "uuid": "8d782e5d-d94a-470e-bcc0-de4c12319a72", "comment": "Malware payload", "value": "95577c5b35f46eb55d748a3745facdd48e304817", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963230, "uuid": "178a9f0e-5f3a-4c1c-9fb7-ced4d1c81425", "comment": "Malware payload", "value": "0cd4befefe27d8311d1413795b91ce3fcfa0885247b7dd30d6d66fb0704c7f00b3bc30a0e644be1ef6cadd42bde0d7f0", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963230, "uuid": "7ab9a8d3-800d-4dba-8f88-f7aac266c05a", "value": "T1A7F42355B4EFD712E17AC03C4CD4262A42C8FE956F38910B7198374E0BB8B7BB58E961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963230, "uuid": "2c08d97a-b7f1-438d-8238-1775727217da", "value": "12288:a+32HTezN4ee+KahN0QwKF2UElH7k1kyaNsUrS/ukjGGf9:aNzeR4eNK1QwKFgEv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963230, "uuid": "b62e003e-36b8-449d-b343-c5c4974042ff", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963230, "uuid": "a287d6ff-72c1-4c3d-965b-6988839f0434", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963230, "uuid": "a60fc2fa-d0c6-4b67-bd9c-ad178e7fe89b", "value": "Order_List_072026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3891e4-7eeb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783968344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968344, "uuid": "97e60669-51fc-4b2d-b0d2-2338477487c3", "comment": "Malware payload", "value": "ba109362e9a98b65761041a92f46e9d1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968344, "uuid": "c3ffafb3-8b86-4f74-b89e-81ea2e8d3d8c", "comment": "Malware payload", "value": "e7f36ff4274b1fa4afb48a002b85aed82d788a399b0db3d5a4e886238777fb37", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968344, "uuid": "9b99947c-9984-4fab-b4f3-610fbd654549", "comment": "Malware payload", "value": "6a30740ca02c1aa44fe00e511348614245346bfc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968344, "uuid": "9accec02-642c-4f72-9277-21b846077f63", "comment": "Malware payload", "value": "2f8620ce6135a1b50b9ae0dccd7689fb189fdb9d455751b84ccc64bb0a085a803f020f959de4b5422492ba87027e555f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968344, "uuid": "c5dd3c17-4cab-476f-a0e1-0cdabf4964f8", "value": "T1E2232912CE9F2D40CB6842BBA1CF05E5195D079F32A20DCF269BF740EE5B4B521D5AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968344, "uuid": "6bf37311-e3de-4a75-9594-0736e56dd17d", "value": "768:wSN7u11CTYLfuI1XrhCZDx2HT7TKjntRqoRs0WQS90i73ErsOToBZE06/6DL5z3:wv40LfuI1bhCZduGjnrxS90i70TiZE0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783968344, "uuid": "66c13a9c-4a7c-4d27-a296-143ecad43f39", "value": 48695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783968344, "uuid": "2794f202-6900-4314-b670-d2460238a2ad", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968344, "uuid": "a4ea0bfe-327c-4a1c-9f5d-677163bdbdc1", "value": "Document.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03779db5-7ebb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783947710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947710, "uuid": "b8b68a20-3d11-47d6-871c-3a34eab2fd08", "comment": "Malware payload (Mirai)", "value": "058099fca6ebbaeffbd52ad2d1ca82cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947710, "uuid": "e3be9197-1d12-49fd-a8d2-e5ca293e7223", "comment": "Malware payload (Mirai)", "value": "e7f7ad9f5170dc0987d29bd2a0d1bc544561bd950b6687d2977560835d5d96d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947710, "uuid": "b9b6f435-fea1-4fb7-9f52-2148ec0dab9b", "comment": "Malware payload (Mirai)", "value": "9311fb79fbfe1b180ed634315457212eb0fc885c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783947710, "uuid": "ed3439a3-91bb-4b5f-a0fd-5853bf388b08", "comment": "Malware payload (Mirai)", "value": "89aeeb5b04a74921da8aa5ed4635153cb83867d410198d024fabe7a798081e33fe6d85e043e2e0a3ccca1a4cfa2dfeb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947710, "uuid": "7d8df963-70d7-4bc9-abdc-5076327b90ef", "value": "T14FA34AC9EA03D4F1F8526E71087BA7368B76D4394136FA81FB612BB16C177109907AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947710, "uuid": "bd6c1a23-8766-4ae9-b060-cbe36c3630da", "value": "1536:1zC0TSD9550ybyhCQdjQ0jZzuxjyofSX1WBwTVaC29zGjVh0lMQRrnul9l9yW:BCHj6LhCQdjQgZYSXgkVGz0v0Xulv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783947710, "uuid": "7b17119c-47bf-4c79-86f2-b748eecc7305", "value": 103568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783947710, "uuid": "396428e8-132e-4b0a-a413-528e6e873b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783947710, "uuid": "4e7e141d-62a1-4618-a0c9-02350af29871", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154d4e52-7ea0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783936144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936144, "uuid": "b95fb5da-9e0b-4931-87d9-66559c76bafe", "comment": "Malware payload (Mirai)", "value": "44543ab36ed47eeb6c1bb78c1ddbf09d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936144, "uuid": "6374d6e8-b11c-4f84-858f-fe2f1227cb6e", "comment": "Malware payload (Mirai)", "value": "e8dbc5618d16d364eaf0991b02db2edc6c840c1d7f9f2d324fec046f46ad238f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936144, "uuid": "d73ed448-a1d8-424c-a883-a555c7047457", "comment": "Malware payload (Mirai)", "value": "b4ebc547e94449b0510acbc4dfc9aa6d53a65375", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783936144, "uuid": "8555ae70-10b1-4f70-b0ae-1f01aeab31ff", "comment": "Malware payload (Mirai)", "value": "afaa0ace4da0d7fae7bec8f8e0aa15f03cd3c8a218c7601ff6feabc7185a46adf9aa7ca83c2cedf19f7b17eff4e7cdc0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936144, "uuid": "fe9320dc-44b1-45b9-ab85-e75596c466cc", "value": "T17201DD99513160B474E69CD747370C5C35E5B0993D967CFC79A7A0EA15B5C01B0820BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936144, "uuid": "710e634f-30ef-44db-83cf-c1ab1796c6a6", "value": "12:YkF1kcClZF70SoHFWHFnHFWnBFSBFM5gFNnBFSXFMDgFNA1LRPb:ZDkH/FboHFWHFnHFWnBF2FM5gFNnBF8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783936144, "uuid": "9cebdda1-ad4c-4632-afb5-7e80c997a794", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783936144, "uuid": "03fc8283-a7a9-44b6-b06f-a311df948a08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783936144, "uuid": "e7410c15-da33-4dee-a7da-1c59f40ecc08", "value": "e8dbc5618d16d364eaf0991b02db2edc6c840c1d7f9f2d324fec046f46ad238f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e1cdb9-7ebe-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783949135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783949135, "uuid": "f2f74077-73f9-4b54-a914-539369aa7a1c", "comment": "Malware payload", "value": "d2649ad454355ae8756be8fab82750d4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "larpers-su", "colour": "#1AF6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783949135, "uuid": "2c88ef08-10bb-4dd1-817a-37695fcdae1e", "comment": "Malware payload", "value": "e8dffd14cfd4d2b0b8daa2f9b2cb9a6481c628712d25ae7eb0774c63d77aac2e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "larpers-su", "colour": "#1AF6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783949135, "uuid": "b48da8ad-bf29-4803-be09-906aaab4ed63", "comment": "Malware payload", "value": "c50d5b9bfa6f9c4a2ef6c5e5cff85615ad6682f1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "larpers-su", "colour": "#1AF6DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783949135, "uuid": "f09dc9db-ffcc-4a2d-98fc-705be6822740", "comment": "Malware payload", "value": "855a0d7fdcd193af48b7eee87489dd61eef84f735d932e5e454d3cb248cf2c8fd8c705e2d1076f9b21e20cf1c733ffc6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "larpers-su", "colour": "#1AF6DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783949135, "uuid": "2068d26a-9e49-4cf8-b9be-27ede0262a44", "value": "T1D531244F7C68E01613A1E2A806BBDA5E7D339E4FC04C694F1D9C5C1A8018FF1800D6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783949135, "uuid": "97a0916b-84f6-4803-ad84-808f8f21ab6c", "value": "48:6fKggQzA5HzzAYFz05rv0YXZoa4Dk5hI42td:Nj1kyk5Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783949135, "uuid": "d770a5fb-067e-4d8d-8820-4632551b0bd6", "value": 1696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783949135, "uuid": "b86d7de0-1a2e-4ea5-af55-22dd9ca3c359", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783949135, "uuid": "0bda15eb-5cee-458d-92e2-bdaea94ce933", "value": "doc.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f82e5bd-7e55-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783904002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904002, "uuid": "dcd87922-26cd-4708-9b9a-9bb4c6c535b8", "comment": "Malware payload (ACRStealer)", "value": "91d8d003272a2df442f288fba6f89044", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dl-connectivityplatform-cc", "colour": "#5A1381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904002, "uuid": "9e3229f1-338e-40c8-a970-f9aaa4835f1a", "comment": "Malware payload (ACRStealer)", "value": "e9a85beb46d004dec0de69d07a2e8a812b5b0d54316be9a66c0658745e54d2a6", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dl-connectivityplatform-cc", "colour": "#5A1381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904002, "uuid": "f2fdca1a-43be-4d23-8459-4963535fdd77", "comment": "Malware payload (ACRStealer)", "value": "77dca9c1a9332d91e71eaf8d2554229a8d9ed8dd", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dl-connectivityplatform-cc", "colour": "#5A1381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783904002, "uuid": "deedda3b-d623-458b-8bb2-33776385e4af", "comment": "Malware payload (ACRStealer)", "value": "c77ad0381833228ab39bf5aa1c82b1e24be56ac8ea58f41adc88d6147a8ac817c78e804b5632bfc20a4825bf5cd3b8a6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dl-connectivityplatform-cc", "colour": "#5A1381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904002, "uuid": "cbc3547c-e106-425d-a784-7adc11e0acbd", "value": "T1BCD49E26DAD281F1E9434476B33FF71FAB361E0A8960C7DAD7F52CA0A972640D94F181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904002, "uuid": "a6b677be-618d-40f6-a493-f76100ccfcd5", "value": "12288:YPTENJXZverMycADRVekdTcVGFXCy52rt3Kz8RgsoUF68+Kqsm:YP4NqMycADRwc4VsSy52rFZgslF6iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783904002, "uuid": "9563be21-d41d-4adb-a685-5948a0a6d010", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783904002, "uuid": "0e97f41f-4241-44aa-b588-a4f92b11d446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783904002, "uuid": "80d29952-0f59-4a17-8ae1-ff89531cb67e", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc301a64-7ea8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783939887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939887, "uuid": "24b730a6-2ddc-47ee-9fd0-aecde4d19d1a", "comment": "Malware payload", "value": "8ff3ae65cdb2a32f00a6bcbb0cdc1783", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939887, "uuid": "48ef8220-57cd-4aa3-bc4b-d6666a701e7d", "comment": "Malware payload", "value": "e9d44973e8de7fd37d78b9fd88189c84d4f966dcf1d12fbcaaf18d4d98ffa66d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939887, "uuid": "d77ce170-3ae9-41d8-a9a9-6d59dddcf780", "comment": "Malware payload", "value": "9317d199aa8047fb0a43985731b303c6f638d2a3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783939887, "uuid": "45718e7a-2193-48cf-8efe-185440327482", "comment": "Malware payload", "value": "06858d4611d81b74bc8ef497663b8ea3565274fe2df79508441c00233d7739e489b25ca9acec4cab00f0c59e9f5b3a67", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939887, "uuid": "d863a58e-09ba-44d2-bd7a-f34e8ae6b037", "value": "T17EA55D78C39A5265BA7659035BC90F4398ADA6B523FFE844A1781FCC037A917D8F430B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939887, "uuid": "61704ed3-262a-4b9b-96ed-0e11d9668448", "value": "12288:LMcl0mq91HQpwq5aCUpDjwvvPsr95nxfYSLf1qjJNDBrSNJItdl60T:MYXXF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783939887, "uuid": "89b6eb0d-2e55-4d67-be8b-231722662467", "value": 2205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783939887, "uuid": "e019541a-fe1c-4692-8ba6-9dd5e07a414b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783939887, "uuid": "63b1f99c-bf9b-4d66-925b-4b47aaf82f22", "value": "SCANDOC713.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4703f977-7e6d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783914323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783914323, "uuid": "e6ccac7b-1ae5-47e7-80fb-001afcf5d68f", "comment": "Malware payload (AsyncRAT)", "value": "0264751f6495eff1100a4c14e5e6a8dc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783914323, "uuid": "f1745c87-d3ad-4d6a-acd7-2fb03fe86a71", "comment": "Malware payload (AsyncRAT)", "value": "ed0f08343c0f3288db6fa05dfbe5722e6a6d39a7d985d198e54c63876fc1c22a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783914323, "uuid": "9aa2ae89-2d41-4a43-81de-110107c95105", "comment": "Malware payload (AsyncRAT)", "value": "e0052a8ad8311e1ca2074362c9828afd6880811a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783914323, "uuid": "01e8e369-99fa-4fc3-aef9-b8a99599ba3d", "comment": "Malware payload (AsyncRAT)", "value": "19d99235759b2c15b7af1289133b4777dfb92806b7ea0f6c067a2d8090c65eaf02f6a93827355dc0efa1a172918f2f55", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783914323, "uuid": "1ad05919-cb00-4eaf-ab8c-d1e8b150b30b", "value": "T18FC22C0833E8C576D1FD4A7D883386109735A95B9D23DB5A5FC490AE2933BC98B14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783914323, "uuid": "37047da6-680d-446c-b958-32d54ad16259", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783914323, "uuid": "9289c387-59bd-47e2-a977-a0f876f11026", "value": "384:lgSVEEMiNPWiilvaR90gVqH9qbuUsAbQxnCJfJBndnjJoKX3:lgSVXFWaIIbqBiBn5X3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783914323, "uuid": "cd491718-cbdb-428a-8906-e16fb08eaa91", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783914323, "uuid": "91129771-3951-461c-9720-d49ec13fa0f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783914323, "uuid": "d42e6094-c9f2-4370-bf61-3ad9564011cd", "value": "S8APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb22e39-7f01-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783978086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978086, "uuid": "a3b48817-1fde-40fe-b406-41cd8413ed14", "comment": "Malware payload (RemusStealer)", "value": "2278019b15ee469c70ca3f5f48bcef20", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5856", "colour": "#870DA7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978086, "uuid": "1fe09e09-2bfc-4354-a25c-c94bbbec49cd", "comment": "Malware payload (RemusStealer)", "value": "ed38c22c7385998f5182bfae0a235faee616ed19fb34b945b1b8e211e3001e96", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5856", "colour": "#870DA7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978086, "uuid": "3ec3925a-7571-4b23-8a1d-952c0f038cd7", "comment": "Malware payload (RemusStealer)", "value": "14c5fda8f8477efebe248f1f563fa1aaa06c6fd1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5856", "colour": "#870DA7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978086, "uuid": "9662ad26-0d32-45cf-9b04-a99d210fadf7", "comment": "Malware payload (RemusStealer)", "value": "fd58a40b1b47a072c1985bc35fdea7fc2d5171663f7151583e3479bcfa78904b3ce8db9121493126727bcf23dfc5dda6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5856", "colour": "#870DA7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978086, "uuid": "48af7121-5c2c-4b44-868f-d62b8e2aab51", "value": "T1CA06332EF535E9F2C7D1EA61410F3F89096C241F288216D8F5863D50A8F67AD47B886F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978086, "uuid": "99b018a7-d8fb-4092-8b86-c308d3caf136", "value": "98304:5guuNEmm51x/nc4PSbZ7i5It8WmbEkckqhdrVHfhYcmabsA1X0Du:5gJN2TZvGZ7MIWXAkckOdtJYbabsMX0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783978086, "uuid": "e7284f50-8126-4cbc-9007-e94d69e2641e", "value": 3926995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783978086, "uuid": "7d50bf54-a701-4cdf-83b1-29cb583b332c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978086, "uuid": "960b2ca5-566e-4119-9bd7-4a226fc3b331", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7ba948-7eea-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783968024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968024, "uuid": "4fa04d88-ebcd-4c15-a22c-775c81b03b94", "comment": "Malware payload", "value": "b938ed556ebe2affa6715de612ccce0f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968024, "uuid": "1f506123-1f39-4f1e-b442-71a0e0e97d57", "comment": "Malware payload", "value": "ed57f128d6f463dac2a6975006a7100cb8978167ce422398e1d4e4b7fe40f934", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968024, "uuid": "47d2a1f6-1055-4254-b8f5-5f2bbcd77970", "comment": "Malware payload", "value": "65ac5bf8a90fe3b5b06f60326b7c1989d64dd1ca", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968024, "uuid": "54cbac44-bf1e-4877-9e76-d480cbc71844", "comment": "Malware payload", "value": "cc2c5cc1d04ac7ac22bda393a23e25eab7ab4b76bbe8638a9beef6ad9c01baa30e776d16b671ffc2778ed425d1614541", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968024, "uuid": "c4a7209e-87a3-43c0-a291-40f6c572c46b", "value": "T13751416E44BEFC10C2E7C373C1BEF3194D2AB48FC664B527426888AC00068D1A5C9AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968024, "uuid": "56e862c4-1106-4e7d-aff5-27490829f642", "value": "48:855IC6G3hHgo4oVdwLCLtSWz/tFK9Uo5A8OADN8+5Mzuzkt8ta8NM:85d6G3SX+hSGVFK9Z5A8OA5t3A8tacM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783968024, "uuid": "d11e8cfe-2c4f-48fb-a8e0-77827f456c0d", "value": 2486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783968024, "uuid": "0ab4360f-bf2a-4158-b1be-ce91d20c547e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968024, "uuid": "18bad432-c5ba-4cb2-a2be-b209a489adea", "value": "Untitled Document.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4169379f-7eaf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783942660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942660, "uuid": "21751900-d0b6-4a95-9aba-fc02e581fddb", "comment": "Malware payload (Mirai)", "value": "8987c55c2ce334bfa90e96c484a8c202", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942660, "uuid": "e4b621a1-d6fa-4f50-837a-5fea592e22bd", "comment": "Malware payload (Mirai)", "value": "ee6a32e2eed51d5740d64ac153690bc149431fa724ad619c7652002fd2cd4bb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942660, "uuid": "cfc512d1-be3e-4338-b934-32e2b063146e", "comment": "Malware payload (Mirai)", "value": "5573f295e4cf7ed696775cd4c54acc85603062c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783942660, "uuid": "49f24a96-0589-4fe8-86b6-6b2fcb49300f", "comment": "Malware payload (Mirai)", "value": "9f78f43c578677926a6787db061d4a01436c7416e67aef311b962510079cc4774dc3158c80324931a57856577ee758cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942660, "uuid": "e1162fa8-e06e-49f1-b40b-17aafdfc6f64", "value": "T16AA35A89EA03D5F0E9466D70087B63378B36E4325136FA87FB617B74AD12710960B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942660, "uuid": "4e7a35f7-27fb-4521-84d0-2d75b5034bc7", "value": "1536:F1z+Zo559WGLTOBCZbKjZ8IHjo7duWICAVacrCySaX9xhMrOUCpRrPp9fK:Ft+aXnWBCt4ZXfWRdcaaNLMaj7pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783942660, "uuid": "3d13bc1a-0be3-4c99-ad02-9e8bc31ffd45", "value": 103568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783942660, "uuid": "8dfbcc83-51c5-46e2-9410-422dfac13356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783942660, "uuid": "2a4161c2-6e61-4fbf-80ec-af2f42282140", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f707a9-7e90-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783929301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929301, "uuid": "90cca3d3-8a44-4164-820f-48e0c9f4daac", "comment": "Malware payload (Mirai)", "value": "d9960d9e09baf87b561ec8d6e284d870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929301, "uuid": "8252040c-a0ff-4ae0-8028-358cc87527b5", "comment": "Malware payload (Mirai)", "value": "eeb1be145778cd2d7974ec00b2eb069614a4225f1f708567401a895ddcc98213", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929301, "uuid": "a3bed439-c08c-4358-9d70-bb5cbe570ca6", "comment": "Malware payload (Mirai)", "value": "4c46d6e7e498996a6ac4108d325fe986fc724526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783929301, "uuid": "d9622794-e8de-48d6-adf6-366221a14cf0", "comment": "Malware payload (Mirai)", "value": "cf8b824a15213c701a87dfdbf8e0a7e8e8ef58354731c66f3c67a8e74231ff1253a65171d49189a636c1e5195f5484a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929301, "uuid": "b0cf4c9b-3433-4e8e-b0d0-fc1e2cc7f266", "value": "T1D1D31849B8929E22C6D216BFFA4F82CD372663E8D3DE7107DD155B21328B52B0E3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929301, "uuid": "aa6ec065-e99d-4ce1-ba13-f2b7e2578ff7", "value": "3072:2Y6BY3gEkeyoaHs+ociU5IbmZyHka0xAesQDOnbF4:2Y6eZkJ/XocioIcha0xMTF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783929301, "uuid": "0034e609-1339-4109-90c9-629a02b93136", "value": 133200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783929301, "uuid": "2b5bf5ae-7db6-4dec-a2bd-1bab6f8082be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783929301, "uuid": "5fbbd023-365f-4a91-8a8b-a95f174d8688", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7e71c3-7e88-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783925850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783925850, "uuid": "6d840a64-088a-4ab6-9138-a2618f12f234", "comment": "Malware payload", "value": "42738fa0c5dc89de5ba2c623da6c76cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783925850, "uuid": "7dfb2171-81e2-42a7-bcd4-0425bc5f19f8", "comment": "Malware payload", "value": "eeddfd10b3649c4336faaf8759656c0f947b3ce2ff418bbffe70bfddd5ba34ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783925850, "uuid": "7796ef35-4301-492d-a489-3f120f66e93e", "comment": "Malware payload", "value": "d429e6ddb5cfe4d80dc8c0cbdec081bd14dfd5e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783925850, "uuid": "16dc484d-a05c-4f64-8903-dfb1cbd19a66", "comment": "Malware payload", "value": "eb31d5367b37641cdc61e9d1cc0b58827326fab5abe66a9d6124d8ec77df2b56eebd6c1fb72fe69f9d1a69d20f3d401a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783925850, "uuid": "3b7d173e-b70b-4b60-9dac-adfed5e436a1", "value": "T15E236D652A817C14AA98D4371D7E2F0CB9AD43E6320492ED7FCF3CF68C4A69D921871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783925850, "uuid": "a2b29a21-bc2e-48e4-98a3-5a5ecdb256ae", "value": "768:WmXOGVvn9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:WoLYcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783925850, "uuid": "822e1a2b-ec7e-4b6d-96ac-9f0cf27bdfa6", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783925850, "uuid": "a1c5cda1-220d-42a4-8f27-c42a11653a0d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783925850, "uuid": "332f6aac-8c46-49ae-8b61-ab401a267340", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963b74fa-7e5b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1783906725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906725, "uuid": "923c168b-ed3f-4fc8-8914-a4d0a78bd56f", "comment": "Malware payload (GCleaner)", "value": "043ecb65c4d4003504dc1d2324bdc7d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906725, "uuid": "435fff83-b411-4ebc-87c8-236de4fab6f7", "comment": "Malware payload (GCleaner)", "value": "eede323c8bd0370140dd9be6fbb92c82cef64210171325352f3e96e7026d3bfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906725, "uuid": "47a7b409-3212-4303-895c-5abb1ce97088", "comment": "Malware payload (GCleaner)", "value": "adfd78e5d0ff90d4d9212f69a4cb5bf95256f463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783906725, "uuid": "a32d6a32-e49f-428b-897c-21e2b734a34f", "comment": "Malware payload (GCleaner)", "value": "b7e1aaac7e0df5942ef1ed1aa050ecc8a4caae766913667942906a06401ea888f9e2d5a6a4e1b3230c7c156912713de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906725, "uuid": "32e81714-0769-47ad-9f04-e83976458336", "value": "T1B7E48E22A2E0C437D2621E7D9D1FE3ED9836BE102D2994462BD45D4C7EF8E837966343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906725, "uuid": "b3bdda74-074d-46e0-b639-69999becb5c0", "value": "b214386fa7f97d3d3252c87b8bce8333", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906725, "uuid": "1d8dcdb9-9618-47e2-956d-d70f76fa3385", "value": "12288:D+ZPf6yIvNeNF682QTY8ZO5NQW41vMPALj7w:69f0YKsTR0zQWsIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783906725, "uuid": "0dc56f26-6966-4373-b8a7-703dc1c650cc", "value": 672528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783906725, "uuid": "4066c43c-cbb6-45e8-88f4-63c7df6ba93c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783906725, "uuid": "24c8495e-2066-4b9e-b858-34e0da38ebc2", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e599a621-7ec3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1783951526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951526, "uuid": "83616032-068b-49dd-8b00-4213e8d5e6f9", "comment": "Malware payload (SnakeKeylogger)", "value": "c2d513cc5651f0f28990256c8fe64c13", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951526, "uuid": "49e19cdf-37b0-4474-8def-35887e51d449", "comment": "Malware payload (SnakeKeylogger)", "value": "efb7d77b5a5489ab803d4b7c5075d0f7a1fac09c96847c28267318205a6937ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951526, "uuid": "76f26257-238e-4b15-a2e2-fbc017e67c43", "comment": "Malware payload (SnakeKeylogger)", "value": "8b835c738696f10357d3d167c30727a4b1d4deaf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783951526, "uuid": "25db88d8-64a0-4fde-bb36-b68141c371f6", "comment": "Malware payload (SnakeKeylogger)", "value": "14b7391984a4e51a6740c9daeeb6615828cec720b6d83aaa590b374ea68fd94043bc0dba5e8e2b2662088d290db937e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951526, "uuid": "48285457-2112-4b82-acfe-ef06397d9edf", "value": "T192B5C04067C0A9AC43DF5F2EB63FB1EAF2E10DD521815886F721BC44FAA6308DE56674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951526, "uuid": "41a02097-5336-4a59-824a-2cd16104f2c0", "value": "24576:oGR8ixIzmbvy22vK4qHmFLQJ6iUVtlhljFBWyQz6nGBUByQKFLQJ6iUVtlhljFBM:oG4P/XqilhlJReqilhlJRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783951526, "uuid": "6589a961-1be6-4c62-9565-cafdadd634e0", "value": 2283506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783951526, "uuid": "72e9e5c9-1282-4a08-a09c-8e6992f035e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783951526, "uuid": "d8cdefb6-9b83-4653-b170-e7a17d24ec86", "value": "MV KALEYS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dff836-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963228, "uuid": "9af1841f-174d-4391-8dff-170a5eae8dcb", "comment": "Malware payload", "value": "90e98242360b6a1ce41dd345e80a6501", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963228, "uuid": "884e1747-c806-45a8-87c6-21be9856322f", "comment": "Malware payload", "value": "f014d2716e01171cab7a8383946b5081843cd7bf301209960a9bd08db0cf7b80", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963228, "uuid": "05391331-d3aa-4829-9894-83f950090a05", "comment": "Malware payload", "value": "5a36ae393e81c13c046c2c8120ca2ee7efda0b81", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963228, "uuid": "03a480f2-adf6-46ae-afed-ada13f200a72", "comment": "Malware payload", "value": "03b14456d25f6be27bc17dca0b884bd9d52db7cb6e222bd8a720f62bda87c10dcd23a6e33d880fbb7edc86c150ee2fae", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963228, "uuid": "e58d82d9-6a1b-4dbe-83e7-69cf6dae053d", "value": "T164F42316FFD6DB1AD6B3F0B40DE0C46A8E1BACA10E65E7571244B71D6334AB482DC718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963228, "uuid": "424ff546-7174-4d62-b95d-56bb7766cf36", "value": "12288:y+32VBY8Y5mgSoGeXw1mvgZOE+ijv/pizzC0FdcXquwc/AZ2yZqYnQl7e/zXWL:yNVTY5mWPXw1mvurjvB0C0vFuw9Z2ygV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963228, "uuid": "0917b0b0-84e9-4885-a0a3-2a88b38a0e7c", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963228, "uuid": "9a317820-15a2-4549-a13c-389ea5c961bc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963228, "uuid": "1645b2f8-0f57-45f7-8df2-7c0d76adf14f", "value": "New Order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e74316d-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783963298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963298, "uuid": "0dd3f0dd-6886-428c-8d67-1865c4519673", "comment": "Malware payload (RemcosRAT)", "value": "c0acd7c7b879a7971f5bf01c36f4cc88", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963298, "uuid": "a930b7c7-ed78-454a-97fd-8557e0f90c9f", "comment": "Malware payload (RemcosRAT)", "value": "f0322826449d40ffbac2ad2be81c72dcb98fd6a38cf719412179e0d089d11fc2", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963298, "uuid": "fbd8d235-f3fd-470b-88a0-bb52fd7b69f4", "comment": "Malware payload (RemcosRAT)", "value": "710537ee294313873fb4de59a698cc642f11070c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963298, "uuid": "3dc690be-6bb1-4125-8dbf-475e97851e43", "comment": "Malware payload (RemcosRAT)", "value": "1ad29004e4254ac10ed827a50a493a1e76e1c001166b5bd2d286758c598f2ee6d951e13ecf9536562b9811709af873c9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963298, "uuid": "68d247fc-4a79-4d4d-a1f8-ec7938023474", "value": "T10C252315BAFADB13E1B794384928C5AE03CAFE587E39815B7164730D367473A318B938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963298, "uuid": "5b184527-de53-4d35-8122-12098e0cc709", "value": "12288:zGfwI82f2eTTezN4ee+KahN0QwKF2UElH7k1kyaNsUrS/ZQ+lrQxkTbKWGDJJdGy:qfwI/uKeR4eNK1QwKFgEjWunKW8rLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963298, "uuid": "5d9f494d-3782-467d-974e-0441dcefd79e", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963298, "uuid": "0f808e3e-9691-4c07-8cbc-dcc543bb6f7a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963298, "uuid": "9add9259-dbb2-42cb-873a-369916c79f42", "value": "Zapytanie ofertowe nr 490526.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c8633e-7f14-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783986179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986179, "uuid": "e908b5fb-28fb-4869-b388-666b528927d7", "comment": "Malware payload", "value": "b7a41bf0be011bef97636dff7741b02d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986179, "uuid": "e850ed0f-5693-4a3d-b434-279d45dcd069", "comment": "Malware payload", "value": "f28e85cb1e61807d9c6f3a9f4f5216d1ae02ad97287626a896151f94116d1e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986179, "uuid": "be230b75-f766-46ba-a2e0-b810743abf1a", "comment": "Malware payload", "value": "80099b56c7b7e9431423b934df2584b9c97eccc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783986179, "uuid": "fbb2ec9e-1ee3-432d-9115-25ad8c6c8eda", "comment": "Malware payload", "value": "15d53b5590f56d2d2c65a5c4a6148b4fd5510151bfb78e74d7159edea7dfc28658fd60b5904ebc1039d3e0857ef060c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986179, "uuid": "1bfa7d2b-856e-4850-ae1c-88ad23c34bda", "value": "T1D6C41240FFD65CDED8B0897949F361634934BCDC8824A65B1288AFAF7E75E40DE39248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986179, "uuid": "2eddb54a-e577-4fea-a2c6-ef54d797afc6", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986179, "uuid": "1ea34477-63ba-4b85-91af-67ac2123152b", "value": "12288:NtgXdATvgWrc7iDSCNvpsXfD7NeQSt+Pl:N6uz/cu9NiXfD7rlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783986179, "uuid": "1142fe4e-b295-46bc-92ba-45b94dd44d0b", "value": 563216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783986179, "uuid": "9bc108ba-5256-478d-ae2e-38775ec8388f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783986179, "uuid": "2050e187-5c6d-4082-b908-b0814e0993c5", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.Minix.cyb.30070.6663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2d7858-7e96-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783931911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931911, "uuid": "ceb13077-76d7-4079-9192-c6464e9b7071", "comment": "Malware payload (SalatStealer)", "value": "57cc2a7038bbd3e297c59144e2f3ed85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931911, "uuid": "3be2143d-c03c-45f8-97ad-55ef74a72220", "comment": "Malware payload (SalatStealer)", "value": "f36467769f8a9e79cf9342a01622cd6a099fb0104f20057c44fa8758823f1c6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931911, "uuid": "5588494f-ddfb-4bca-9762-d3aae0e17653", "comment": "Malware payload (SalatStealer)", "value": "3fe86ee5b3223af55f54554f37003ab8a33e9b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783931911, "uuid": "17f4d9b0-0605-4858-867e-5ec13aea46de", "comment": "Malware payload (SalatStealer)", "value": "f4d54da846f337080d592ba22b4d954f3dd951f190e57053623500d4b2aca4600d86aa1f90b1528d73852e7d202052ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931911, "uuid": "d3bb970a-6fe4-476d-9984-00fe1ce6a183", "value": "T187F5331BFDB45FC8FCC242B7D7D8BA8822F0462479D4E369E56D201EE59310528A9BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931911, "uuid": "1a3871f7-327a-4124-9a5e-93bf2c226b04", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931911, "uuid": "46f90280-01e3-41e4-9ab7-034401ebf6fd", "value": "98304:jBW7O5ewR7PlvFo7D0xTXa5j7LBk5WgTWEV:jIG7PlvFo7ya5e5WgTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783931911, "uuid": "eaa934af-6c42-41c2-ba43-8b210df2ded0", "value": 3588096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783931911, "uuid": "c03464b1-d163-4157-a7b0-dec633ad9456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783931911, "uuid": "7d772dd7-9f74-49db-b882-7f9d0c22265f", "value": "SecuriteInfo.com.Trojan.PWS.Salat.390.5067.13976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51df70e8-7ee3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783965022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965022, "uuid": "b35176b5-2a9c-40e7-b024-f13494bcf654", "comment": "Malware payload (Stealc)", "value": "a99f45b68c21a8965a7bbbcc759cd6af", "object_relation": "md5", "Tag": [ { "name": "103-101-85-184", "colour": "#E744E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965022, "uuid": "12625350-2e30-4b17-8b0e-89c7cb4a5282", "comment": "Malware payload (Stealc)", "value": "f3ba907b03f07e2886fe2012a5f40d4d1c7edfb655b1b2d5d9452234a694edbe", "object_relation": "sha256", "Tag": [ { "name": "103-101-85-184", "colour": "#E744E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965022, "uuid": "ba29d30c-32d2-4ae1-91cc-bd931b020ded", "comment": "Malware payload (Stealc)", "value": "8e8512cda86f235652d21189e40f80f851c77f9b", "object_relation": "sha1", "Tag": [ { "name": "103-101-85-184", "colour": "#E744E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783965022, "uuid": "f04b8d4b-271b-4221-97fa-d60b2b2c57f8", "comment": "Malware payload (Stealc)", "value": "359c224f9f6df56436f59794f5d95a03e39e068a881d3adfcf7f628030747c78fb39d1d195acbeb1459ced4b089449c5", "object_relation": "sha3-384", "Tag": [ { "name": "103-101-85-184", "colour": "#E744E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965022, "uuid": "82f1b267-d382-41cb-8aee-3d51cae194b3", "value": "T1F3666C03EC5555E8C0AED2718A729263BB717C885B3163D32B50F2392F76BD0ADB9358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965022, "uuid": "440d2f55-b3bc-4790-86ad-6c899b349bf8", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965022, "uuid": "d784a154-aacc-4945-9e80-5bd68b91053e", "value": "49152:fe2+gG6Lzc7xuSdwNayNzDeDqkogzWzFzcavSz2jPH/EWuyouMwLw8v4KQK1K6eA:fenb6fO8eRkvHQybvJeNnAuiEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783965022, "uuid": "32e34bf9-f936-40c5-82d0-e372132daa1e", "value": 6980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783965022, "uuid": "4c57129c-66b2-4989-9771-f5f0a13ae7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783965022, "uuid": "b7f96c54-c462-4122-a910-ffe602167bab", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d9ba7d-7ecd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783955636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955636, "uuid": "0a6d687e-84a5-4dd6-b01f-99d6dcfc8c49", "comment": "Malware payload (RemcosRAT)", "value": "c1c470362063083222d7b11d1910bc7c", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955636, "uuid": "eabdb4ec-c61d-4bdb-9c6d-abe5b90cb31d", "comment": "Malware payload (RemcosRAT)", "value": "f40ea5ac575869f142664b2b54221429922392d495b3e0f8cc8d6759cdfca276", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955636, "uuid": "9c33b90a-09c4-411b-b653-5e0956178194", "comment": "Malware payload (RemcosRAT)", "value": "f7ab9a10fe6164a6de3168bab85690582c01e4df", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783955636, "uuid": "1780acf6-c649-46df-9266-a87e183e3f8e", "comment": "Malware payload (RemcosRAT)", "value": "ae72d8ee89a9156530fb1d45412e334870e6e622cc5990509022a94fced42bf4e9d5b59da88b9544e0d7a03c9d663372", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955636, "uuid": "fefd2e1b-4ae1-4130-a667-d4b689405127", "value": "T1C6D27C1532A6C012E15599724DD9D2DF2B20BCA3AE27CA0F3385770F29799A1D817F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955636, "uuid": "f6a2dfe6-628f-41f7-9dc0-f6a53d8785fb", "value": "384:dzP2JXmLLEdSSiFn53ihctVlWmsQB4BgvNn1NX:dwVd/iF5SMWwB4Bg1n1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783955636, "uuid": "88f3fcc4-f212-4335-bb2b-d8f610cec7a4", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783955636, "uuid": "db9bc2e6-f959-447b-985f-84de32c5a4ec", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783955636, "uuid": "3fe31fc1-da26-449b-9f5e-c0a588230f68", "value": "\u03a0\u0395\u039b\u0391\u03a4\u0397\u03a3 084035-00.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fd0e9e-7ede-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783962968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962968, "uuid": "622afa4f-93f1-4ec2-8a69-80994485ee3e", "comment": "Malware payload", "value": "661d2f5c01ef75340afbecd7e9e53ac2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962968, "uuid": "5932430c-2515-44a9-9393-52d8e435fffe", "comment": "Malware payload", "value": "f514bdd056f1dc820943370241de7f3f0e492fd4cadeaf834f0c71400d6f6566", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962968, "uuid": "a808945b-b562-422a-9cc0-5a1b84e29642", "comment": "Malware payload", "value": "ecf20ebcb827572797898415ad7c53b392644514", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783962968, "uuid": "0c2b9666-fb5c-4d5a-8abb-3e136a14653a", "comment": "Malware payload", "value": "a8404ca6e4792e9f34b1ac1473daa5d3d9cab3e968104242ca92f359d726bd09f82129e0c14915e434dff883f0305a52", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962968, "uuid": "05156356-de6d-4917-9ae8-c91bd6cc0753", "value": "T1D4B2C064E1616908E76B583ED22841F2B78D7609EC52E2DA3094F65EB6423F7139F8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962968, "uuid": "434d7f33-2068-4fa6-bd87-6f13f6663359", "value": "384:VYsR+s3gurhcLU7EugepoLUlM9zWBG6vrkk+qfrMEd7VmZeE5UHbW9RaBe:VYsQOThH7+xMG5kFhVmZeE5wb0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783962968, "uuid": "b6ca7912-501b-425e-9dde-55436648f54b", "value": 23790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783962968, "uuid": "7953118f-5820-4a87-9408-13f27cb4019b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783962968, "uuid": "a179c76f-fd79-4094-8cc4-1c620bcfb489", "value": "PSCO 001 PURCHASE_ORDER_JULY2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59b3d33-7ed8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783960572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960572, "uuid": "92778c94-d458-4ed0-98f3-3cd6fbec363f", "comment": "Malware payload (Mirai)", "value": "70b3f0cfda200d877b3c3c818011b031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960572, "uuid": "407c01e2-9337-4145-9eb4-aa27991b8f20", "comment": "Malware payload (Mirai)", "value": "f54fd54715e63d1dcf70ac5169f0c42e0043fbcc8b311b466993aae02e8c9562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960572, "uuid": "27d8de53-6da1-4ee7-b982-45f1e3ec9640", "comment": "Malware payload (Mirai)", "value": "86fb121433a979e4750b3b39b78854498a758a8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783960572, "uuid": "3b7b3bd3-ea11-43a3-93aa-b0e17b6d5ccd", "comment": "Malware payload (Mirai)", "value": "f43a824b25e50ab20cfb01c5564e095407f302eb0c18c90f2e1f8c17d84cd52b2c20e61bc7cc09e04dc737d512aba730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960572, "uuid": "0daa6912-8d33-4047-8e17-ded5d154d0ce", "value": "T13B332AA5BD41AA12C6C1157BFF0F428D77274398E2EE7303AA266F3037978660E3B155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960572, "uuid": "358574cb-0349-4941-a51a-54c5c58de0d5", "value": "768:eS+GSesn1/x0gC+PQDvn3BfcmMtuEwyleEOwYamIoMeVMmIel7s9ljlgR3I:fsnBivxItuseEOwdofDwDRgR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783960572, "uuid": "2cf35416-b866-4fd5-8bbf-e088d30552e2", "value": 54408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783960572, "uuid": "a137d796-e239-46fc-8ecf-24a0c318cddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783960572, "uuid": "62841481-50fd-4a1f-b32b-6cb671a6948d", "value": "SecuriteInfo.com.ELF.Mirai-COW.76673575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c77472-7e61-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783909410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783909410, "uuid": "1a4a518b-111d-4c9c-ba61-1311c9b3d143", "comment": "Malware payload", "value": "516105b33f53a38b52e3132f28f4d5a9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783909410, "uuid": "e5616d79-b60c-4bc5-a61e-327e04837bdf", "comment": "Malware payload", "value": "f6a5fcb77d8ce9826007dfaed36f9c40891c3c9fe54808744c977414eac668b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783909410, "uuid": "8ac592c8-ce53-4fd7-92c2-59dd6d9cd60c", "comment": "Malware payload", "value": "765c134c551c9aa6b1ed502d632e294b263c7109", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783909410, "uuid": "6a64c1cb-c6de-41d1-a3bf-4669fcd5fa9f", "comment": "Malware payload", "value": "6cb9b08ccf8138461d8c5b78105be51764885b39439357e0c0d5e70eeb25d9383594ef0b0e46f0c31d976595ac07a27a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783909410, "uuid": "5af53a43-7454-401b-8be9-d5fd4c63d29d", "value": "T157236C551A857C149A99C4371D7E2F0CBDAD43E6320852EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783909410, "uuid": "6856cc9b-801d-4363-ab32-00345bee36fc", "value": "768:JVEJVIhtMm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:nEJ2MDcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783909410, "uuid": "292f3ee7-4702-41eb-906e-34dd662a7600", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783909410, "uuid": "c41189b6-a714-412a-9773-118e9d51233c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783909410, "uuid": "99a18342-b816-4eff-88a2-2188b9b53f35", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee55402-7eb4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783944965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944965, "uuid": "a48e9b29-cf90-4a01-8b95-96f12071bcc2", "comment": "Malware payload", "value": "932db63fa05b06bf10cdf3ba9899e84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944965, "uuid": "2940ebad-67b6-47b7-a3e4-dfdc9e2fc7a1", "comment": "Malware payload", "value": "f7d4968ffb4ed98d9f7582e0f1729b16259958aea718cf1ea5bf04d9c4f25c7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944965, "uuid": "22cab453-ab3c-4957-8aaa-a02bd46adb7d", "comment": "Malware payload", "value": "12e306963f0d7f34c38c69fe28308ce2856a5003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944965, "uuid": "afb43a17-205a-4dff-b4f7-1b842e091b4e", "comment": "Malware payload", "value": "8045b6761d666ce68af2e40409b0b76324196dd74470d682d42d70cfc7baa9b2a926d5f9ebc92e4f0c5a764c7fc468f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944965, "uuid": "48e72fb5-4904-4e2e-8cf9-b218bcc65dc2", "value": "T1B78607EB33A59128D56AF23AC0938F04D8F3B4750733CAE795910F6A5A02AD4DE3B574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944965, "uuid": "2ecc6bd5-33f5-419f-888b-146b84af807f", "value": "fc8f02921a06b9af961f79067d418147", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944965, "uuid": "a46ed2a6-d11c-40bd-8f1e-cbbaab9f5d86", "value": "49152:JvlqNe/jFjueZYTXeHbmA+6SSagoz0pJjp/TGVUim13Le4a++FUQRR/LyGkkCN:LDnz6g13K7RR2LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783944965, "uuid": "2d45b82a-61a1-49f1-b001-a8678f8a2ec6", "value": 8589552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783944965, "uuid": "77ebe414-5534-4397-bebc-1969da5bd54b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944965, "uuid": "dbb6b3b3-7073-4253-ba53-01faff06d140", "value": "Lumen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da24be12-7eb3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783944634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944634, "uuid": "1e9fe604-756f-407e-889b-dde1e1f253d6", "comment": "Malware payload (Formbook)", "value": "16b426d9f5c009f63fb9ed6bc85ada6d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944634, "uuid": "2c135ca8-5dd0-46f5-bab3-ae38bc1a1ec7", "comment": "Malware payload (Formbook)", "value": "f913434f31b44c0e9df986028468ed3d6d28fd86d6d88aab48f2ef3841609386", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944634, "uuid": "e0238563-64da-4d63-8d1d-6b09d3c7b0bc", "comment": "Malware payload (Formbook)", "value": "50ae69ac5871577b31cbe2f95e436b95eb1b10f1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783944634, "uuid": "2cd7c29a-5cf6-4510-baf5-0b595ef59fd1", "comment": "Malware payload (Formbook)", "value": "6e1cbeccccb7dfad3463c4bfd38b32ec3e58ebbff090d071859eccc0498d4768276c5bd9230af96c6ef1485639be5f41", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944634, "uuid": "21c0dc81-ea90-481e-89ec-36e5854cfb09", "value": "T18325337BD72935E4EFCD96911EC61EF31AC5E42FDF28827A20D717235B1E124421D2A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944634, "uuid": "f5682c12-2b5e-4d03-97ee-fd989807d1d7", "value": "24576:0ZjgF9FItoG+RmOKyMoTv1S63h/GSA3EHwVVLJxAbtKBD/0:IjVhMKfoTvD3h/GSA34w7dxWAj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783944634, "uuid": "405f8dc4-c20a-4a46-9ab8-5f6df933cf64", "value": 1030557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783944634, "uuid": "cad0fb0d-5645-4d7c-80d8-8823c57e820d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783944634, "uuid": "b893ed2d-0b2d-4604-ad72-e4c84d88fa2c", "value": "Nostro Ordine 264418.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5171914b-7f02-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783978335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978335, "uuid": "c0877df6-828e-4662-aebe-1cd9e630ebe4", "comment": "Malware payload (RemusStealer)", "value": "3421de0f4fe56f3d6a7c86f281f5115e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978335, "uuid": "687ee6a3-e8f2-4ba5-b38e-55f563ba3f0c", "comment": "Malware payload (RemusStealer)", "value": "fa38f6539af74b5b355c532a3c71c588960d34abd825442fea98c2177375d010", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978335, "uuid": "abf03251-60db-4d5b-914d-a995ee732c7a", "comment": "Malware payload (RemusStealer)", "value": "bd93017965afb4ff0ed13768b450aa56e0fc7231", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783978335, "uuid": "afbce820-1743-4948-9976-440877d1f3df", "comment": "Malware payload (RemusStealer)", "value": "ff8cf61810d0beb9e4f25170a08c6201d10a14e5114249328bf445f2c1f976342ae906fda5e56736057a9df2eb19d07b", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978335, "uuid": "ea7e2197-0aad-4ea0-b2da-d18b69fb46e9", "value": "T17FA56B0B7CD049E9C8AA673188B261927B35BC194F3627D32E90B7783E727E15D36784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978335, "uuid": "ea74d3e9-0d14-4abd-9932-5567cc96d207", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978335, "uuid": "24a76fa0-96d7-4263-b6e0-55f2137ebe00", "value": "24576:LfRbwvSN00WoClYV67JJxAkJ4vFXaNQ5r+NVMuzSBqAnQTXN69txzBele5rK263G:LfNCS20WFuixUFB6QemqAnC8ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783978335, "uuid": "bcc9a3f9-2fce-4c03-a000-e1fabed51c91", "value": 2173440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783978335, "uuid": "efa4dda7-7eba-42fd-954b-983bf481e815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783978335, "uuid": "c999df2f-770d-4b76-b600-3b2d7007c140", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68436164-7ee2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783964630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964630, "uuid": "48b44456-adc0-4c68-a8c7-ea3ecd3f3ada", "comment": "Malware payload", "value": "6083d08ea3a2d9c8c30cd46f7212d07c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964630, "uuid": "5bf5a27f-59d6-46b4-be95-957c13fd2394", "comment": "Malware payload", "value": "faf843506d455c5ecd8b5f9af63c5b65306fb6bc59f17f9c5baf73f07c59dfca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964630, "uuid": "b6f47b43-dd37-4c19-858a-5cec50740204", "comment": "Malware payload", "value": "7fbd959e21d5e9e933003c4c68101b815da8610e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783964630, "uuid": "a4a01830-cb45-48fb-94c9-c64d48c75010", "comment": "Malware payload", "value": "bd50b1ad8de1d8199b8850168d9d3bd20573fe318efae66f7940c962e47421c8fd696566f1e608a83f26b3df68636ea6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964630, "uuid": "e2c15b8b-d62c-4a2b-b22f-20985cc3ed5c", "value": "T1E8848FA2A4105ADFCE0089BA736C8F3563823C70C25B1F7D1D568159A28F8DBF5D6BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964630, "uuid": "9126d792-ea5e-4b96-ba8e-07b87ca56fec", "value": "6144:9lws0roqNDRU3j/7J42QRQpsy1NSsBhxdt:9lwxroeDRUi26Qay1PBh7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783964630, "uuid": "bbd058a3-1918-47a4-b5a0-fd2cf00f1a6b", "value": 371540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783964630, "uuid": "6d713e6d-fe15-43f5-9710-16058467f5dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783964630, "uuid": "f26f9f22-dffc-4b9d-b9c8-e2d293aa1ff4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8f5d01-7ee8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783967459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967459, "uuid": "67f90c9b-98b6-4953-a858-9413b6121d22", "comment": "Malware payload (Stealc)", "value": "5db4d6f453638ed0efa2b0da08bac381", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967459, "uuid": "36ff0b36-6ecd-47cb-95b3-8dc434514841", "comment": "Malware payload (Stealc)", "value": "fb53841dd09252611470ab59b7455cb8a25679ee145d65210ffb179167a6f452", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967459, "uuid": "c055f665-f5a7-4d5c-89ef-c9074d36dca4", "comment": "Malware payload (Stealc)", "value": "c22ae328f8c98b7730ccefdeb0e85085ae7bd84a", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783967459, "uuid": "124ec127-e729-4620-b6e1-c5ac5acac51f", "comment": "Malware payload (Stealc)", "value": "5b17ff9a0977df9bcea50021498848bb9b539d724098527734017d6fc430582a92d6afe734901f7ee9cf6d34e1ed0e17", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967459, "uuid": "cce4c4c0-d3e8-418a-bd2d-6ee6ce3d5fb3", "value": "T164968C0BBCD148E9C8AA673288B651917B35BC090F3A27D72E60B7382F367D15D36B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967459, "uuid": "ea9ad720-3a27-4771-95f1-6f9f57629a0a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967459, "uuid": "f77b83e3-b8c4-4fa5-8381-d3e966da42d5", "value": "49152:fWYBW/GyruukxsBe+mti/AE8n+VM1E9UeAjYaIUbDR:fWYy5e+mdd51YAjYaFbDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783967459, "uuid": "ca788105-2ab1-4278-8a83-c21790dfbf7c", "value": 9078200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783967459, "uuid": "24733dc0-c076-4e20-a637-5d2a7c8f97d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783967459, "uuid": "da3791d0-01fe-4e41-8ca1-28e6b5e86f2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8921c0d-7eea-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783968174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968174, "uuid": "b5324773-7707-4d76-84a4-6238decb6eec", "comment": "Malware payload", "value": "29b96de24e7b9808eb419625d5587331", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968174, "uuid": "3646a2c6-4bd2-4ef8-8fce-c59f3bcd591e", "comment": "Malware payload", "value": "fd1f37c361549bbcc18cbc17a40bb571dc3ba1703e517c9816b8e4452543666b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968174, "uuid": "a002e887-8e04-4d58-880a-cbcddec172e4", "comment": "Malware payload", "value": "025f482a5ad9505f73914160f674624a77668167", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783968174, "uuid": "4211daa5-9229-4345-8b7f-95d54a57804d", "comment": "Malware payload", "value": "406bddf9a2890d6e174d37c57dc7edf3be155a8be726d7d45976fae973023e5381a605a9fbcacb229e0811820485d040", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968174, "uuid": "517b11e3-0d3d-43e5-b08e-7b734aaf45dc", "value": "T163C27D956A867C44BEC94A3E8CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968174, "uuid": "f2690fe1-4f00-492b-9980-7edd34550a70", "value": "768:Mk8vCB+25j6es8RB9FYpMSUpi+20qUpi+20YQX:Mk8l25J3d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783968174, "uuid": "42962e26-2809-4d57-be54-731429810427", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783968174, "uuid": "02a75389-641c-4d36-85eb-de56a89e9928", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783968174, "uuid": "d439dd3c-0d93-4254-aa90-a5ae6c8a5a2d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91fbdec-7e65-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783911132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783911132, "uuid": "cab1926c-0b1d-48ec-bec4-fc208aa4179d", "comment": "Malware payload (Efimer)", "value": "37a467e33e90d404c041e9f7d1de4727", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783911132, "uuid": "f77ae74d-350d-41ae-8b0f-70f7119552be", "comment": "Malware payload (Efimer)", "value": "fe5bb7f1f37e84ec4f13c583e9020428caec52a7fdf3b06c0811ed1ce6d826ed", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783911132, "uuid": "0e0d6de7-dd42-4433-9791-b9e633562383", "comment": "Malware payload (Efimer)", "value": "91f1a89b15e43871f441917eea55c86baa083609", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783911132, "uuid": "a093c2be-2265-42c2-bdfc-8d34846ae020", "comment": "Malware payload (Efimer)", "value": "ecbe7f5f2dd60f19bdcf98a9fa38fdd996993f0dc893dd4bf2c8d1eebb15a3fc01068e3ba12a4022263c8483eee8d5fa", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783911132, "uuid": "bde6a52a-9010-4b4c-b013-561f9ba9b5a3", "value": "T18EE6332416C006EFD6B3923DEDA21D65D2B6707F0732C8EB1BB4979A6E131E14C3E616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783911132, "uuid": "b775d1b4-335f-48ed-975b-c2a9a1b6e8b2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783911132, "uuid": "8e5dbd05-19af-416d-8b23-9ec9f5ad517a", "value": "393216:2rUw8dNgugziRaFNTqgjGXMCHWUjXccuI3/PGTAI:2wwY6u/oXugjGXMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783911132, "uuid": "e1256371-30b9-412e-a82d-5aaf8ebf94b7", "value": 14297783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783911132, "uuid": "0e97955c-f8c0-4f35-a3d6-bd758946944f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783911132, "uuid": "312b0885-6f05-4483-9dea-016e46a3b425", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491dcd7b-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963289, "uuid": "3ea8c09c-3c1f-4ff4-abf6-c79d765aff5b", "comment": "Malware payload", "value": "8975fa03ffe91cb2ccd25d89731b426c", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963289, "uuid": "0ea46542-856c-48e2-96e1-887bc3120121", "comment": "Malware payload", "value": "fe87e1ce57b6435849be96b1dbab8bd9395a5177146246a79ef023ae1f5190d8", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963289, "uuid": "c366618b-b40f-4193-bcbd-fcc368c1766b", "comment": "Malware payload", "value": "d14ccacf92287d88b58ee763edd114af4b3ad99f", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963289, "uuid": "4eefb2a5-ca1d-4b1b-bf7c-7beb64caf97f", "comment": "Malware payload", "value": "5fca7febeab2a1da4bb4ed5f2eb675a4775a1cd9cf775dff2a9728da156047e3e70eb4b7222b5d14f84cb34805d6b6c4", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963289, "uuid": "b97e19f5-efb9-43b6-bbdf-e05dae6bab47", "value": "T1FBF4235572FEEB13D1BA803D8DE4212E468CFEA4AF3592077094370E0BB4B6A718DE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963289, "uuid": "98d7ca17-639e-4301-b32d-d0c6c526bf66", "value": "12288:w+32aTezN4ee+KahN0QwKF2UElH7k1kyaNsUrS/uczHR5tZT:wNmeR4eNK1QwKFgEDD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963289, "uuid": "91d7db44-be42-4015-9baa-7ec40fdb8d25", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963289, "uuid": "14073bda-17e4-4312-9214-6596670596e8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963289, "uuid": "963d6b59-9343-4844-ba42-2cb6c79d8b3f", "value": "PO29678.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467d3f28-7edf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783963285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963285, "uuid": "f0752595-7f46-4897-9644-4abdfe13cd7a", "comment": "Malware payload", "value": "30e85f4d971c0adecf692c393550bb7e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963285, "uuid": "40457d22-a947-44ed-9828-91c6c4b2474e", "comment": "Malware payload", "value": "ff2bb2057d515aa7ebe4c184d82c606fb268afaad92d0b0cc195f92c34e196e8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963285, "uuid": "a93aca9d-09a4-41f4-a546-2c4fc543769b", "comment": "Malware payload", "value": "05ddfbed08528d59c52ed520309707aab1422fe7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783963285, "uuid": "109c8c84-1730-4ef9-a470-190f17248d5e", "comment": "Malware payload", "value": "033414251478346829bd8f486c6775242ac923624e2573deb7c44aa3a06111ff1a13fc701331c542fd4b5ed33597bb58", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963285, "uuid": "08614cb0-bc60-4eed-b3aa-8769c460ba54", "value": "T1A4F42308F6CFCA5BCA57683A94E1C56E415CFD821F0AE247B1627F0F1076B1AD6CB614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963285, "uuid": "ed661961-bd6a-4bee-af18-ab7bf2dc45fe", "value": "12288:/+32MeNCpDyYufWSGBaO0N5zVdGAaET9xwH0HKfrXxj7N8FKDQ7u3PBexD5dlOLS:/NzcZyYKbcp0NjdGAjPTExjhywUx5fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783963285, "uuid": "158f6b7d-f9e4-4882-9e00-2183fa52068d", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783963285, "uuid": "d563b317-9c41-47b5-b225-03f6535e64f7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783963285, "uuid": "e2e3ccfa-c8f5-4a3e-87df-7716b9b9b050", "value": "Shipping document.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afd8b52-7e8a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783926758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926758, "uuid": "2d58cc63-70de-4c25-bd4c-7d44cb78a4ec", "comment": "Malware payload (RemusStealer)", "value": "97bf92b1957a3d08d1c3b0b0611f0b11", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926758, "uuid": "d0496084-5c74-4876-bd5a-9f9c78309d44", "comment": "Malware payload (RemusStealer)", "value": "ffa78f3d4b1dafb9723e6a68456e42a57c0a109b9b8246196e1a8a6d6d2d6f5a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926758, "uuid": "004cd6af-857f-4745-a060-e175a74c7f9d", "comment": "Malware payload (RemusStealer)", "value": "2f3919a47832081c3b1c548ed62cb9b4497401a8", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783926758, "uuid": "d412a0d5-4cfc-4d30-9b04-aff482789174", "comment": "Malware payload (RemusStealer)", "value": "625f3121e7b014a18fbfbb99a5c5eeb558b796d845bdbb97e0487f2eac77f53a52061d0dfec37842b12a5da8aa698914", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926758, "uuid": "cd09d693-e8ff-4d8b-b5d0-ac67651449ac", "value": "T19DE35D17E6AA30FAD1678978C8520905EB327C768791ABDF43504EF61E236D4CE3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926758, "uuid": "ff114242-53ab-470b-ac69-3a56f085869b", "value": "6136b6e1a5aba557804a70cdc31e7bc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926758, "uuid": "71cf76b3-e621-45a0-aba8-57a613a69cf9", "value": "3072:qUz/+pjAXSVYa+bwaNyiHBC2KuWiHpITdQVUnzVv6bo:POGGaRC5kQxib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783926758, "uuid": "51f81718-c785-44b5-9abf-9b0a4353ece4", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783926758, "uuid": "22a1274b-2029-435b-b5c6-3e962deac7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783926758, "uuid": "cab3f3cf-5b55-4e0e-816d-ed02f3286980", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }